CVE-2026-106246 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the browser component of Google Chrome, specifically affecting versions prior to 155.0.8059.39, represents a significant breach in the integrity of user interface elements that are critical for establishing trust during web interactions. This issue stems from a failure in the access control mechanisms governing how the address bar renders information relative to page content loaded via crafted HTML pages. In modern browser architectures, the separation between the chrome UI and the webpage rendering engine is designed to prevent malicious sites from mimicking legitimate system prompts or navigation indicators. However, this specific flaw allowed a remote attacker to manipulate the visual representation of the URL displayed in the address bar through sophisticated CSS manipulation or DOM injection techniques embedded within a specially crafted HTML page. By exploiting this discrepancy, an adversary could make a phishing site appear as if it were hosted on a trusted domain, thereby deceiving users into believing they are interacting with a secure and legitimate service rather than a malicious entity designed to harvest credentials or deliver malware.
From a technical perspective, the root cause lies in how the browser processes style rules and layout calculations for the address bar overlay when dealing with complex or obfuscated HTML structures. The vulnerability likely involves an edge case where certain CSS properties or JavaScript-driven DOM modifications bypassed the sanitization filters intended to isolate user interface elements from page content. This allows the attacker's code to visually overlap or replace the genuine URL text with a fabricated string that matches a target organization’s domain name, even though the actual network request is directed elsewhere. Such spoofing attacks are particularly dangerous because they exploit human psychology rather than technical exploitation of memory corruption or execution flaws. The user perceives a valid HTTPS connection and a familiar domain in their address bar, leading to a false sense of security that bypasses standard vigilance against phishing attempts.
The operational impact of this vulnerability is primarily centered around social engineering success rates for attackers conducting targeted campaigns. By successfully spoofing the address bar, an attacker can significantly increase the likelihood of users submitting sensitive information such as login credentials, financial data, or personal identification details to a fraudulent server. This undermines the fundamental security model of web browsing which relies on visual cues provided by the browser UI to authenticate identity and trustworthiness. Furthermore, this flaw could facilitate drive-by download attacks where users are tricked into executing malicious scripts under the assumption that they are visiting a safe site. The severity is classified as medium because while it does not allow direct code execution or arbitrary memory access on the victim's machine, its potential for widespread exploitation in phishing campaigns makes it a high-risk issue for end-users and enterprises relying on Chrome for secure communications.
In terms of industry standards classification, this vulnerability aligns with CWE-284 Improper Access Control, as it involves an unauthorized ability to modify UI elements that should be restricted from user-controlled content manipulation. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts and specifically the sub-technique of Impersonation within the Initial Access or Credential Access tactics, where attackers use spoofed interfaces to gain trust. Additionally, it relates to CWE-295 Improper Certificate Validation if the attack involves manipulating visual cues related to security indicators like padlock icons alongside URL text. The remediation strategy implemented by Google in version 155.0.8059.39 and later involved tightening the isolation between the browser chrome and web content, ensuring that CSS styles from webpage contexts cannot leak into or alter the rendering of address bar elements. Users are strongly advised to update their browsers immediately to mitigate this risk. Organizations should also enforce strict Content Security Policies and educate users on verifying URLs through multiple channels rather than relying solely on visual appearance in the browser interface.