CVE-2026-106302 in Chrome
Summary
by MITRE • 10/06/2026
UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as a user interface misrepresentation within the PermissionElement component of Google Chrome prior to version 155.0.8059.39 represents a significant trust boundary violation that undermines the integrity of browser-based permission prompts. This flaw allows for the spoofing of critical UI elements, specifically those responsible for requesting access to sensitive user resources such as camera, microphone, location services, or clipboard data. By manipulating the visual presentation and contextual information displayed during these permission requests, an attacker can create a deceptive interface that appears legitimate but is fundamentally misleading regarding its origin and intent. This type of vulnerability falls squarely under CWE-201: Insertion of Sensitive Information into Sent Data, although in this context, it manifests as the insertion of false or manipulated visual data to deceive the user rather than leaking actual sensitive information directly through network channels.
The operational impact of this flaw is primarily centered on social engineering effectiveness and the erosion of user trust in browser security mechanisms. When a remote attacker hosts a crafted HTML page that exploits this UI misrepresentation, they can trick users into granting permissions under false pretenses. For instance, an attacker might display a permission prompt that mimics a trusted site or system dialog while actually originating from a malicious domain. This deception allows the attacker to bypass user scrutiny, leading to unauthorized access to private data streams such as real-time video feeds, audio recordings, or precise geographic location history. The severity is classified as medium because it requires active user interaction and social engineering rather than purely automated exploitation, yet its potential for widespread impact through phishing campaigns remains high due to the critical nature of the permissions involved.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078: Valid Accounts or more specifically T1566.002: Spearphishing Link if delivered via email, but most accurately maps to T1049: System Network Configuration Discovery when used for location tracking or T1113: Screen Capture when abused for camera access. The core tactic is Deception (T1565), where the attacker manipulates the user's perception of reality to achieve unauthorized access. The exploitation relies heavily on the psychological principle that users often grant permissions based on visual cues and perceived legitimacy rather than verifying domain names or certificate details, making this a potent vector for initial compromise in targeted attacks.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements within browser security models. Users should immediately update Google Chrome to version 155.0.8059.39 or later, where the underlying logic governing PermissionElement rendering has been corrected to prevent spoofing attempts. Browser vendors are encouraged to implement stricter separation between UI presentation layers and content injection points to ensure that permission dialogs cannot be visually overridden by page content. Additionally, security awareness training should emphasize verifying domain names in permission prompts rather than relying solely on visual design elements. For organizations deploying Chrome via enterprise policies, enforcing automatic updates through centralized management consoles is critical to ensuring all endpoints are protected against this class of UI spoofing vulnerabilities before they can be leveraged in active campaigns.