CVE-2026-106243 in Chrome
Summary
by MITRE • 10/06/2026
Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as a high-severity issue within the Chromium-based browser engine, specifically affecting Google Chrome versions prior to 155.0.8059.39, centers on an incomplete cleanup mechanism in the Proxy Authentication module. This flaw represents a critical failure in state management during network request handling, where sensitive authentication credentials or session tokens are not properly erased from memory after their intended use or upon connection termination. In complex web environments that rely heavily on proxy servers for traffic routing and security filtering, the browser must maintain strict isolation between different authentication contexts to prevent credential leakage. When this cleanup process is bypassed or executed incorrectly, residual data remains accessible in system memory or internal buffers long after it should have been purged, creating a persistent attack surface for malicious actors operating within the same network segment.
From a technical perspective, this vulnerability falls under the category of improper resource cleanup and can be mapped to CWE-459, which describes incomplete cleanup of non-volatile resources. The operational impact is significant because it allows an adjacent attacker, typically defined as another user or device on the local area network or same subnet, to intercept or extract sensitive information via crafted network traffic. By manipulating proxy requests or exploiting race conditions in how authentication headers are processed and discarded, an adversary can potentially capture plaintext passwords, OAuth tokens, or other confidential credentials that were intended for secure transmission through a corporate proxy. This type of attack does not require remote exploitation over the internet but relies on physical or logical proximity to the victim's network connection, making it particularly dangerous in enterprise environments where internal threats are a primary concern.
The security implications extend beyond simple credential theft, as compromised authentication data can lead to unauthorized access to protected web services and corporate resources. This aligns with ATT&CK technique T1539, which involves Stealing Web Session Credentials, specifically when the attacker leverages local network position to intercept these credentials before they are encrypted or after they have been decrypted for proxy validation. The ability of an adjacent attacker to obtain this information undermines the confidentiality guarantees provided by HTTPS and secure proxy configurations, effectively allowing lateral movement within a trusted network boundary if those stolen credentials grant access to internal systems.
Mitigation strategies primarily involve immediate software updates to ensure that all endpoints are running Google Chrome version 155.0.8059.39 or later, where the incomplete cleanup logic has been corrected and proper memory sanitization routines have been implemented. For organizations unable to patch immediately due to compatibility constraints, network-level controls such as strict proxy authentication policies using certificate-based mutual TLS can reduce reliance on password-based proxies that are susceptible to this type of credential leakage. Additionally, implementing network segmentation to limit the ability of adjacent devices to sniff traffic and monitoring for unusual patterns in proxy authentication failures or retries can help detect potential exploitation attempts while longer-term remediation plans are executed.