CVE-2026-106312 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization in the sign-in process of Google Chrome, specifically affecting versions prior to 155.0.8059.39, represents a critical flaw in how browser extensions interact with user authentication states. This issue stems from an insufficient access control mechanism within the extension API or internal handling logic that governs permission validation during credential submission flows. In a properly secured environment, any operation requiring elevated privileges, such as accessing sensitive user data or modifying account settings via an extension, must undergo rigorous authorization checks to ensure the requesting entity has explicit and verified consent from the user for that specific action. The absence of this check allows maliciously crafted extensions to bypass standard security boundaries, effectively tricking the browser into treating unauthorized requests as legitimate operations initiated by a trusted source.
From a technical perspective, the flaw exploits the trust relationship between the Chrome runtime environment and installed extensions. When an extension is loaded, it operates within a sandboxed context that grants it certain capabilities defined at installation time or during dynamic permission requests. However, if the sign-in mechanism fails to re-validate these permissions against the current user session state or requires explicit confirmation for sensitive data access, attackers can leverage social engineering tactics to deceive users into installing and activating such extensions. Once active, the extension can intercept or manipulate authentication tokens, cookies, or other credentials without triggering the expected security warnings that would normally alert a cautious user to potential risks. This bypass of authorization logic is particularly dangerous because it relies on human error rather than complex exploitation techniques, making detection by automated security tools significantly more difficult.
The operational impact of this vulnerability centers on data exfiltration and identity compromise. A remote attacker leveraging social engineering can craft an extension that appears benign or useful to the target user but contains code designed to harvest sensitive information such as saved passwords, autofill data, browsing history, or session tokens upon successful sign-in events. Because the authorization check is missing, the extension gains access to this privileged information without requiring additional user consent for each specific action involving sensitive data retrieval. This leads directly to potential account takeover, financial fraud if banking credentials are compromised, and broader privacy violations as personal communications and private files may be exposed. The severity rating of Low in Chromium reflects that while the technical exploitation is straightforward due to the missing check, the reliance on social engineering limits its automated scalability compared to zero-click exploits, yet it remains highly effective against targeted or unsuspecting users who do not scrutinize extension permissions carefully.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary defense is upgrading Google Chrome to version 155.0.8059.39 or later, where the authorization logic for sign-in processes has been corrected to enforce strict permission validation before allowing extensions to access sensitive user data. Organizations should implement policies that restrict extension installation from untrusted sources and require administrative approval for all third-party add-ons. User education is equally critical; individuals must be trained to review the specific permissions requested by each extension during installation, paying close attention to those requesting broad access to browsing data or credentials. Additionally, deploying browser security solutions that monitor for anomalous behavior patterns associated with credential harvesting can provide an additional layer of defense against social engineering attacks aimed at exploiting this class of vulnerabilities. Regular audits of installed extensions and removal of unused add-ons further reduce the attack surface available to potential adversaries seeking to leverage missing authorization flaws.