CVE-2026-106311 in Chrome
Summary
by MITRE • 10/06/2026
Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as Clickjacking within the PermissionElement component of Google Chrome prior to version 155.0.8059.39 represents a significant user interface manipulation flaw that exploits the browser's permission request mechanisms. This issue stems from an insufficient separation between trusted UI elements and untrusted web content, allowing malicious actors to overlay deceptive interfaces over legitimate browser prompts. By leveraging social engineering techniques, attackers can craft HTML pages designed to trick users into interacting with hidden or disguised buttons associated with sensitive permissions such as camera access, microphone usage, location tracking, or notification approvals. The core technical flaw lies in the rendering engine's handling of z-index and pointer events within the PermissionElement context, where the browser fails to properly enforce click-through protection or visual isolation for these critical security dialogs.
From a technical perspective, this vulnerability aligns with CWE-1021 Improper Restriction of Rendered UI Layers or Clickjacking (CWE-847), as it involves manipulating the presentation layer to deceive end users into performing unintended actions. The attacker constructs a malicious webpage that embeds legitimate-looking permission dialogs using iframes or CSS positioning techniques, often making them transparent or offset so they appear innocuous while actually capturing user clicks intended for other visible elements on the page. When a victim interacts with what appears to be a harmless button or link within the crafted HTML environment, their input is inadvertently directed toward the hidden PermissionElement dialog. This mechanism bypasses standard user awareness safeguards because the visual feedback does not correspond to the actual action being executed by the browser's security subsystem.
The operational impact of this vulnerability is severe in terms of privacy and system integrity compromise. Successful exploitation allows remote attackers to gain unauthorized access to sensitive hardware resources or personal data without explicit, informed consent from the end user. For instance, a victim might believe they are clicking on an advertisement or navigating to another site, while simultaneously granting web application access to their webcam or microphone. This leads to potential surveillance, eavesdropping, and exfiltration of private information under false pretenses. The medium severity rating assigned by Chromium reflects the reliance on social engineering for exploitation; however, given the ubiquity of phishing campaigns and deceptive advertising networks, the practical risk remains high as users are increasingly targeted through sophisticated lures that mimic trusted interfaces.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK technique T1053 Scheduled Task/Job, specifically in the context of user interaction manipulation, though more accurately it falls under T1204 User Execution and T1615 Indirect Command Execution via UI Redressing. Attackers utilize these methods to establish persistent access or initial footholds by compromising trust boundaries within the browser environment. The lack of robust frame-busting scripts or modern clickjacking prevention headers in certain contexts allows this attack vector to persist, particularly when third-party content is involved or when permissions are requested dynamically during page load sequences that users do not closely monitor.
Mitigation strategies primarily involve upgrading Google Chrome to version 155.0.8059.39 or later, where the Chromium team has implemented fixes for the PermissionElement rendering logic and enhanced clickjacking protections. Administrators should enforce automatic update policies across all endpoints to ensure timely patching of browser vulnerabilities. Additionally, users can mitigate risk by enabling strict site isolation features within Chrome settings and avoiding interaction with permission prompts that appear unexpectedly or are visually inconsistent with standard browser behavior. Security awareness training remains critical, emphasizing the importance of verifying the context and origin of any dialog requesting sensitive permissions before interacting with it. Web developers should also ensure their applications do not inadvertently contribute to such vulnerabilities by properly implementing Content Security Policy directives like X-Frame-Options or frame-ancestors to prevent their legitimate interfaces from being embedded in malicious contexts.