CVE-2026-106262 in Chrome
Summary
by MITRE • 10/06/2026
Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incomplete cleanup issue within the GetUserMedia API of Google Chrome prior to version 155.0.8059.39 represents a significant breach in browser isolation and user interface integrity. This flaw specifically affects the handling of media stream permissions, where the internal state management fails to properly reset or clear resources after a request is denied, cancelled, or otherwise terminated by the user. In modern web browsers, the GetUserMedia API allows websites to access hardware peripherals such as cameras and microphones. To maintain security, this process involves strict permission checks and UI prompts that inform users when their media devices are being accessed. The deficiency in cleanup logic creates a window of opportunity for an attacker who has already achieved partial code execution within the browser's renderer process to manipulate these states improperly.
The operational impact of this vulnerability centers on the potential for user interface spoofing, often referred to as UI redressing or clickjacking variants specific to media access prompts. By leveraging social engineering techniques alongside a crafted HTML page, an attacker can exploit the incomplete cleanup state to make it appear that the user has granted permission for camera or microphone access when they have not, or conversely, hide active recording indicators. This deception undermines the fundamental trust model of the browser, where users rely on visual cues and system-level permissions to control their privacy. If successful, this could lead to unauthorized surveillance, data exfiltration through audio or video streams, or further exploitation vectors that depend on convincing a user they are interacting with a legitimate interface rather than a malicious overlay.
From a technical classification perspective, this issue aligns closely with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the state manipulation involves bypassing permission checks through residual data states. More critically, it maps to MITRE ATT&CK technique T1566.001 Phishing: Spearphishing Attachment or Link when considering the social engineering component required to trigger the crafted page. The attack vector also relates to T1059 Command and Scripting Interpreter if we consider the JavaScript execution context within the renderer, but the core flaw is a state management error that allows for privilege escalation in terms of user perception and consent. The Chromium security team has classified this as Medium severity because while it requires an initial compromise or successful social engineering to load the malicious page, the resulting ability to spoof UI elements poses a direct threat to end-user privacy and trust.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these cleanup routines have been corrected to ensure that all media stream resources are properly released and state variables are reset upon any termination of the GetUserMedia request. For organizations managing large fleets of endpoints, enforcing automatic browser updates is essential to close this gap. Additionally, users should be educated on verifying permission prompts carefully, looking for system-level indicators such as OS-specific camera or microphone icons that appear in the taskbar or status bar, which are harder to spoof than browser-internal UI elements. Security monitoring tools can also be configured to detect unusual patterns of media device access requests originating from untrusted domains, providing an additional layer of defense against exploitation attempts that rely on this specific state manipulation flaw.