CVE-2026-106264 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization in the Web Authentication implementation within Google Chrome versions prior to 155.0.8059.39 represents a critical flaw in how user interface elements are rendered during passkey and security key authentication flows. This issue stems from an insufficient validation of the origin or context associated with the cryptographic operations initiated by web pages requesting credentials via the WebAuthn API. When a website invokes this API to authenticate a user, Chrome is responsible for displaying system-level dialogs that confirm the action and display relevant details such as the relying party's name and domain. The flaw allows an attacker who controls a malicious HTML page to manipulate these UI elements or trick the browser into presenting them in a misleading manner, effectively bypassing standard visual cues that users rely on to verify they are interacting with legitimate services rather than phishing sites.
From a technical perspective, this vulnerability falls under CWE-287, which describes Improper Authentication, specifically within the context of user interface deception and trust boundary violations. The attacker leverages crafted HTML pages designed to exploit how Chrome handles the presentation layer during authentication requests. By manipulating the parameters or state associated with the WebAuthn request, an adversary can cause the browser to display spoofed UI elements that mimic legitimate login prompts from trusted domains such as banking institutions or email providers. This technique is a form of user interface redressing, where the visual representation of the application is altered to deceive the end-user into believing they are authenticating with a different entity than the one actually requesting access.
The operational impact of this vulnerability is significant because it undermines the primary defense mechanism against phishing attacks: human verification. Even though WebAuthn and security keys provide strong cryptographic guarantees that prevent credential theft, their effectiveness relies heavily on users correctly identifying which service they are authenticating to. If an attacker can spoof UI elements, a user might unknowingly approve a login attempt for a malicious site by clicking through what appears to be a standard Google Chrome authentication dialog. This could lead to unauthorized access to sensitive accounts, session hijacking, or the compromise of multi-factor authentication setups that depend on physical security keys. The Chromium project has classified this issue with a Low severity rating, likely due to the complexity required for successful exploitation and the reliance on user interaction, but it remains a serious threat in social engineering scenarios.
This behavior aligns closely with MITRE ATT&CK technique T1621, which involves Multi-Factor Authentication Interception, specifically through UI redressing or phishing variants that target authentication prompts. The attacker does not need to break the cryptographic protocol itself; instead, they exploit the trust users place in the browser's interface to facilitate unauthorized actions. To mitigate this risk, it is imperative for organizations and individual users to update Google Chrome immediately to version 155.0.8059.39 or later, where these authorization checks have been strengthened. Additionally, security awareness training should emphasize verifying the domain name displayed in authentication dialogs rather than relying solely on visual design elements that can be spoofed. Implementing strict Content Security Policies and ensuring browsers are configured to display full URLs during authentication prompts can further reduce the effectiveness of such UI-based attacks.