CVE-2026-106216 in Chrome
Summary
by MITRE • 10/06/2026
Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as CVE-2024-6789 represents a significant breach in the integrity of Google Chrome's ReadingList feature on Android devices, specifically affecting versions prior to 155.0.8059.39. This flaw is classified under Cross-Site Request Forgery, commonly abbreviated as CSRF, which fundamentally undermines the assumption that user actions are initiated voluntarily and without coercion from external sources. In this specific context, the vulnerability allows a remote attacker to exploit social engineering techniques to trick an authenticated user into performing unintended actions within their ReadingList interface. The core of the issue lies in the insufficient validation of request origins or tokens during state-changing operations performed by the ReadingList component, thereby permitting malicious web pages to forge requests that appear legitimate to the browser's security model.
From a technical perspective, the flaw stems from an inadequate implementation of origin checks within the HTML page handling logic for saved reading items. When a user interacts with their saved list, such as deleting or modifying entries, the application fails to strictly enforce same-origin policies or utilize anti-CSRF tokens that are unique per session and tied to specific actions. This oversight enables an attacker to craft a malicious HTML page containing hidden forms or automated scripts that submit requests to Chrome's internal endpoints for ReadingList management. Because these requests originate from within the browser context of the authenticated user, they bypass standard web origin policies designed to prevent cross-site scripting attacks and unauthorized data manipulation. The Chromium security team has assessed this vulnerability with a medium severity rating, reflecting its potential impact on user privacy and data integrity rather than immediate remote code execution or system compromise.
The operational impact of this vulnerability is primarily centered around the violation of user intent and the potential for malicious modification of saved content. An attacker leveraging social engineering could deceive a victim into visiting a specially crafted webpage that silently triggers actions within their ReadingList, such as deleting important articles, adding links to phishing sites, or altering metadata associated with saved items. This not only disrupts the user's workflow but also erodes trust in the browser's ability to protect personal data collections. Furthermore, if the ReadingList feature integrates with cloud sync services, these forged requests could propagate corrupted or malicious state changes across multiple devices linked to the same Google account, amplifying the scope of the damage beyond a single device instance.
To mitigate this risk, users must upgrade their Chrome installation on Android to version 155.0.8059.39 or later, where the underlying logic for request validation has been hardened against such forgery attempts. Security administrators and developers should also review any custom implementations of similar features within enterprise environments to ensure strict adherence to anti-CSRF best practices, including the use of synchronized tokens and rigorous origin verification. From a broader security architecture standpoint, this incident highlights the importance of applying defense-in-depth strategies where even trusted internal components are subject to stringent input validation and state management protocols. The vulnerability maps directly to CWE-352, which describes Cross-Site Request Forgery as a weakness in application logic that allows attackers to send unauthorized commands from a user who has an active session with the vulnerable web application. Additionally, it aligns with MITRE ATT&CK technique T1071, specifically Application Layer Protocol: Web Protocols, where adversaries use standard protocols like HTTP/HTTPS to exfiltrate data or manipulate state without triggering typical network-based security controls. By addressing these foundational weaknesses in request handling and origin validation, organizations can significantly reduce their exposure to social engineering-driven attacks that target user session integrity.