CVE-2026-106309 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization issue within the selection handling mechanisms of Google Chrome on iOS prior to version 155.0.8059.39 represents a significant flaw in how user interface interactions are validated against underlying data access controls. This specific defect allows a remote attacker, through the delivery of a maliciously crafted HTML page, to bypass intended restrictions and extract sensitive information that should remain inaccessible to unauthorized entities. The core technical failure lies in the browser's handling of selection events on mobile platforms, where the logic governing what content can be selected or copied fails to adequately verify whether the user has explicit permission to access the underlying data structure at that specific moment. This misalignment between the presentation layer and the security policy enforcement mechanism creates a pathway for information disclosure that does not require complex exploitation techniques beyond social engineering via web delivery.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Assignment or Incorrect Authorization. The flaw manifests when the browser processes selection commands initiated by user interaction with a webpage designed to exploit this gap. By crafting an HTML page that triggers specific JavaScript events or DOM manipulations, an attacker can force the browser to expose internal state information, clipboard contents, or other sensitive data elements that are typically protected from script access due to same-origin policies and sandboxing restrictions. The severity is rated as low by Chromium security standards because it primarily results in information disclosure rather than arbitrary code execution or full system compromise, yet it remains a critical concern for privacy-conscious users who rely on the browser to isolate web content from local device data.
The operational impact of this vulnerability centers on the potential leakage of sensitive user data during routine browsing activities. An attacker hosting the malicious HTML page can trick a victim into interacting with specific elements that trigger the flawed selection logic, thereby causing Chrome to return restricted information back to the script running in the context of the webpage. This could include personal identifiers, authentication tokens stored in memory, or other private details depending on what data is accessible via the DOM at the time of exploitation. While the attack vector requires user interaction with a crafted page, which limits its automated scalability compared to drive-by downloads, it remains effective against users who may not recognize malicious indicators within web pages. The ability to obtain sensitive information through such means undermines the confidentiality guarantees provided by modern browser security models and can facilitate further attacks if combined with other vulnerabilities or social engineering tactics.
In terms of industry alignment, this incident maps directly to MITRE ATT&CK technique T1005, which covers Data from Local System Retrieval via Browser-based mechanisms. The exploitation relies on the attacker leveraging legitimate browser functionality in an unintended manner to exfiltrate data, a common pattern in web application attacks where trust boundaries are misinterpreted by the software implementation. Remediation for this issue is primarily achieved through updating Google Chrome on iOS to version 155.0.8059.39 or later, which includes patches that correct the authorization checks within the selection handling code path. Users should ensure their mobile browsers are kept up to date with the latest security releases from official app stores to mitigate exposure to such flaws. Additionally, adopting best practices such as avoiding interaction with untrusted web content and utilizing browser extensions that enforce stricter privacy settings can provide supplementary layers of defense against information disclosure vulnerabilities in mobile environments.