CVE-2026-106253 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the extensions subsystem of Google Chrome, specifically affecting versions prior to 155.0.8059.39, represents a significant breach in the browser's isolation mechanisms. This issue stems from improper access control logic that governs how web extensions interact with cross-origin resources. In modern browsers, the principle of least privilege and strict origin separation are fundamental security models designed to prevent malicious or compromised content from accessing data belonging to other origins. When an extension is granted specific permissions, it operates within a sandboxed environment intended to limit its scope. However, in this instance, the authorization checks were insufficiently rigorous, allowing extensions with seemingly benign or limited privileges to bypass these boundaries and access sensitive cross-origin data that should have remained inaccessible.
From a technical perspective, this flaw likely involves a failure to properly validate the origin of requests made by extension scripts against their declared permissions or manifest definitions. Extensions often utilize APIs such as fetchXMLHttpRequest or similar network interfaces to communicate with external servers or internal browser pages. If the validation logic fails to distinguish between legitimate cross-origin access permitted by policy and unauthorized exfiltration, an attacker can craft a malicious Chrome extension that exploits this gap. By leveraging standard web technologies available within the extension context, the attacker can construct requests that retrieve cookies, local storage data, session tokens, or other sensitive information from different domains than where the extension was originally invoked. This bypasses the Same-Origin Policy protections that normally shield user data across distinct websites and services accessed through the browser.
The operational impact of this vulnerability is severe for end-users who install third-party extensions without thorough vetting. A remote attacker can distribute a maliciously crafted Chrome extension through official or unofficial channels, enticing users to install it under the guise of providing useful functionality such as ad blocking, password management assistance, or productivity enhancements. Once installed and granted permissions by the user, the extension operates with elevated trust within the browser environment. The ability to obtain cross-origin data means that sensitive personal information, financial details, authentication credentials, and private communications could be silently exfiltrated to an attacker-controlled server. This compromises not only individual privacy but also organizational security if used in enterprise environments where employees might install unvetted tools on corporate devices.
This vulnerability aligns with CWE-269, which describes Improper Authorization, as the core issue is a failure to enforce access controls correctly during runtime operations involving extensions and cross-origin resources. Furthermore, it maps to MITRE ATT&CK technique T1530, Data from Local System Exfiltration, specifically within the context of browser-based attacks where attackers leverage installed software components like extensions to harvest data. The medium severity rating assigned by Chromium reflects that while exploitation requires user interaction such as installing an extension, the potential for significant data loss and privacy violation is high due to the privileged nature of extension APIs compared to standard web page scripts.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these authorization checks have been corrected to enforce stricter origin validation and permission scoping for extensions. Users should exercise caution when installing browser add-ons, preferring those from verified publishers with high ratings and transparent privacy policies. Enterprise administrators can implement allow-listing strategies using Chrome Policy settings to restrict which extensions are permitted on managed devices, thereby reducing the attack surface presented by potentially malicious third-party code. Regular auditing of installed extensions and removal of unused or suspicious tools further reduces risk. Additionally, keeping all browser components updated ensures that known flaws in extension handling mechanisms are patched promptly before they can be leveraged in targeted attacks.