CVE-2026-106323 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization in Google Chrome for iOS prior to version 155.0.8059.39 represents a critical failure in access control mechanisms within the browser's rendering engine and associated APIs. This flaw allows an attacker, who typically relies on social engineering tactics such as phishing or malicious web page hosting, to bypass intended security boundaries. The core technical issue stems from insufficient validation of user intent or context when executing privileged operations through HTML-based interfaces. Specifically, certain JavaScript functions or DOM manipulations that require explicit user interaction or higher privilege levels were accessible without the necessary authorization checks. This oversight enables a remote attacker to craft an HTML page containing malicious scripts that exploit these unchecked pathways, effectively tricking the browser into performing actions it should have rejected due to lack of proper authentication or consent from the end-user.
From a technical perspective, this vulnerability falls under the category of improper access control, which is formally classified as CWE-269 in the Common Weakness Enumeration database. The attack vector involves leveraging standard web technologies like HTML and JavaScript to trigger internal browser functions that are not properly gated by security policies designed for mobile environments. In iOS applications, sandboxing is a primary defense mechanism intended to isolate application processes from one another and from system resources. However, when an attacker can execute arbitrary code outside the expected sandbox constraints through this authorization bypass, they effectively escape these isolation boundaries. This escalation of privilege allows the malicious payload to interact with sensitive APIs or data stores that are normally protected by iOS security protocols, thereby compromising the integrity of the user's device and personal information stored within the browser context.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution on a widely used mobile platform. By successfully exploiting this flaw, an attacker could install malware, steal session cookies or credentials, access private data such as saved passwords or browsing history, or even use the device as part of a botnet. The reliance on social engineering means that while the technical exploit is potent, it requires user interaction to initiate, typically by visiting a malicious website designed specifically for this purpose. This makes targeted attacks more feasible and increases the risk profile significantly compared to purely automated exploits. Users who visit compromised or attacker-controlled sites face immediate risks of data exfiltration and device compromise without their knowledge or consent.
To mitigate these risks, it is imperative that users upgrade Google Chrome on iOS to version 155.0.8059.39 or later immediately upon availability. This update contains the necessary patches for the authorization checks within the browser engine, ensuring that privileged operations are correctly validated before execution. Additionally, organizations and individual users should employ defense-in-depth strategies such as enabling content security policies where applicable, using reputable ad blockers to reduce exposure to malicious scripts, and maintaining strict awareness of phishing attempts. Security teams should also monitor ATT&CK techniques related to client-side exploitation and social engineering, specifically looking for indicators of compromise that align with browser-based code execution patterns. Regular software updates remain the most effective countermeasure against such vulnerabilities in web browsers.