CVE-2026-106282 in Chrome
Summary
by MITRE • 10/06/2026
UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as a user interface misrepresentation within the WebOTP feature of Google Chrome, specifically in versions prior to 155.0.8059.39, represents a significant trust boundary violation that exploits the browser's automated handling of one-time passwords. This flaw allows a remote attacker to manipulate or spoof UI elements through the delivery of a crafted HTML page, thereby deceiving the end-user into interacting with malicious content under false pretenses. The core technical issue lies in how the browser renders and presents OTP suggestions during the autofill process, where visual cues intended to indicate legitimate system-generated prompts can be overridden or mimicked by attacker-controlled web pages. This misrepresentation breaks the implicit contract between the operating system's security layer and the user interface, leading users to believe they are interacting with a trusted native component rather than a malicious webpage element designed to harvest sensitive authentication data.
From an operational perspective, this vulnerability facilitates sophisticated phishing attacks that bypass traditional visual inspection by victims. When a user visits a malicious site crafted to exploit this flaw, the attacker can display fake OTP input fields or notifications that appear identical to legitimate browser prompts. Consequently, users may inadvertently enter their one-time passwords into these spoofed interfaces, which are then transmitted directly to the attacker's server rather than being used for intended authentication on trusted domains. This mechanism effectively neutralizes two-factor and multi-factor authentication protections, as the user is tricked into authorizing access or completing transactions without realizing that the credentials have been compromised. The severity of this issue is classified as medium by Chromium security standards because while it does not allow direct code execution or memory corruption, its impact on identity theft and account takeover can be severe depending on the sensitivity of the affected accounts.
This vulnerability aligns closely with CWE-201, which describes insertion of sensitive information into an incorrect location, specifically where user interface elements are manipulated to mislead users about the source of data requests. Furthermore, it maps directly to MITRE ATT&CK technique T1583.004, known as Acquire Infrastructure: Domains, and more broadly to social engineering tactics involving spoofing within the context of credential harvesting. The attack vector is classified as remote with low complexity, requiring only that a victim visits a malicious webpage or interacts with content embedded therein via an iframe or similar mechanism. There are no additional privileges required for exploitation other than standard user-level access to browse the web, making it particularly dangerous in environments where users frequently interact with third-party sites or receive links from untrusted sources.
Mitigation strategies primarily involve upgrading Google Chrome to version 155.0.8059.39 or later, which includes patches that correct the rendering logic and enforce stricter separation between native UI components and web content. Until such updates are applied, users should exercise heightened caution when prompted for one-time passwords, verifying that the prompt originates from a trusted system notification rather than within the browser window itself. Security administrators can also implement strict Content Security Policy directives to restrict how OTP-related APIs interact with external origins and monitor for anomalous patterns in authentication logs that might indicate successful exploitation of this UI spoofing technique. Additionally, enabling advanced phishing protection features in Chrome provides an additional layer of defense by analyzing page content against known malicious indicators before rendering potentially deceptive interfaces.