CVE-2026-106324 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the WebAppInstalls component of Google Chrome for Android represents a significant breach in the application's privilege management logic. This issue, which existed prior to version 155.0.8059.39, stems from insufficient validation mechanisms when handling requests related to Progressive Web App installations or updates. In a properly secured environment, the browser must strictly enforce system-level access restrictions and user consent protocols before allowing web content to interact with native device features or install applications that require elevated permissions. The failure in this specific component indicates that the security boundary between untrusted web content and trusted system resources was not adequately maintained during the installation workflow.
From a technical perspective, the flaw allows a remote attacker to bypass these critical access restrictions by delivering a specially crafted HTML page to an unsuspecting user. When the victim visits this malicious site, the embedded code exploits the authorization gap within WebAppInstalls to trigger actions that should normally require explicit user approval or higher privilege levels. This exploitation vector relies on social engineering tactics where the attacker entices the user into interacting with the webpage, potentially through deceptive UI elements or misleading prompts designed to mimic legitimate system dialogs. Once triggered, the crafted script leverages the misconfigured authorization checks to execute operations outside the intended scope of a standard web page context.
The operational impact of this vulnerability is substantial as it compromises the integrity and security posture of the Android device running Chrome. By bypassing system access restrictions, an attacker could potentially install malicious applications without proper user consent or modify existing app configurations in ways that facilitate further compromise. This can lead to unauthorized data collection, persistence on the target device, or even lateral movement within a network if the compromised application gains access to sensitive local resources. The medium severity rating assigned by Chromium reflects the potential for significant harm while acknowledging that successful exploitation typically requires user interaction and specific environmental conditions.
This incident aligns with CWE-269, which describes Improper Privilege Management, specifically highlighting failures in enforcing security policies regarding elevated privileges. Furthermore, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, as the attack involves executing code via a crafted web page that abuses system APIs through the browser's installation interface. The vulnerability underscores the importance of rigorous input validation and strict separation of duties within complex software components like browsers that bridge web content with native operating systems.
To mitigate this risk, it is imperative to update Google Chrome on Android devices to version 155.0.8059.39 or later immediately upon availability. This patch addresses the underlying authorization logic errors in WebAppInstalls and restores proper enforcement of access controls. Organizations should also implement mobile device management policies that restrict browser configurations where possible, disable automatic app installations from unknown sources, and educate users about the risks of interacting with untrusted web content. Regular security audits and penetration testing focused on privilege escalation vectors within mobile browsers can further help identify similar weaknesses before they are exploited in the wild.