CVE-2026-106289 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as missing authorization within the Federated Credential Management API, commonly referred to as FedCM, in Google Chrome versions prior to 155.0.8059.39 represents a significant deviation from expected browser security boundaries. This flaw specifically impacts the mechanism by which browsers handle identity assertions and user consent flows between web origins. The core technical issue lies in the failure of the browser's internal authorization checks during the execution of FedCM operations, allowing scripts originating from one domain to interact with authentication contexts or retrieve sensitive credential metadata intended for a different origin without proper validation. This breakdown in isolation enforcement undermines the fundamental principle of same-origin policy, which is designed to prevent malicious pages from accessing data belonging to other sites.
From an operational perspective, this vulnerability allows a remote attacker to exploit the flaw by crafting a deceptive HTML page that triggers unauthorized interactions with FedCM endpoints or identity providers. When a victim user visits such a crafted page while logged into a service that utilizes FedCM for authentication, the browser may inadvertently process requests or expose information in violation of origin restrictions. The severity is classified as medium because while it bypasses critical security controls, it typically requires user interaction and specific contextual conditions to be fully exploited. However, the potential impact includes unauthorized access to identity-related data, session hijacking risks if combined with other vulnerabilities, and a general erosion of trust in the browser's ability to isolate web content securely.
This type of vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges or accessing resources without proper authorization checks. Furthermore, from the perspective of the MITRE ATT&CK framework, this behavior can be associated with techniques related to credential access and potentially initial exploitation vectors that rely on social engineering through malicious web content. The lack of strict origin validation in FedCM operations creates a pathway for attackers to manipulate identity flows, which is particularly dangerous given the increasing adoption of federated login systems across major internet services.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these authorization checks have been reinforced to ensure that FedCM operations strictly adhere to origin boundaries. For organizations relying on this browser for enterprise environments, ensuring automatic update policies are in place is critical to prevent exposure. Additionally, developers integrating third-party identity providers should implement additional client-side validation and monitor for anomalous behavior patterns that might indicate exploitation attempts. Security teams should also review their web applications for any reliance on implicit trust assumptions regarding FedCM responses, as the browser's internal safeguards must be complemented by robust application-level security controls to maintain a defense-in-depth posture against origin bypass attacks.