CVE-2026-106328 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the PDF handling component of Google Chrome on Android represents a significant breach in access control mechanisms, specifically affecting versions prior to 155.0.8059.39. This issue stems from a failure in the browser's internal security model to properly validate permissions when interacting with external applications or local file systems associated with PDF documents. In modern mobile operating environments like Android, applications operate within strict sandboxing boundaries designed to prevent unauthorized data access between different apps. However, this vulnerability exploits a gap where Chrome fails to enforce these isolation protocols correctly during the processing of Portable Document Format files, thereby allowing unintended information disclosure paths that bypass standard security checks.
The technical nature of this flaw involves improper authorization logic when handling resources linked or embedded within PDF documents. When a user interacts with a maliciously crafted PDF file, potentially through social engineering tactics such as receiving a deceptive email or visiting a compromised website, the browser may inadvertently grant elevated privileges to co-installed applications on the device. This misconfiguration allows an attacker who has already established a foothold via a local application installed on the same Android device to leverage Chrome's processing capabilities to access sensitive data that should remain isolated within the browser's sandboxed environment. The severity is classified as medium by Chromium security standards, indicating that while exploitation requires specific conditions such as user interaction and pre-existing presence of malicious apps, the potential for data exfiltration is substantial.
From an operational impact perspective, this vulnerability enables a local attacker to obtain sensitive information without direct system-level privileges or root access. The attack vector relies heavily on social engineering to trick the victim into opening a specially constructed PDF file within Chrome. Once opened, the flawed authorization mechanism allows co-installed apps, which may be benign but compromised by other means, or explicitly malicious applications present on the device, to read data that was intended for exclusive use by the browser session. This could include cached credentials, personal documents stored locally, browsing history details, or other private user data associated with the PDF context. The reliance on social engineering makes this vulnerability particularly dangerous in enterprise environments where employees may be targeted through phishing campaigns designed specifically to exploit mobile device vulnerabilities.
This incident aligns closely with Common Weakness Enumeration (CWE) category CWE-269, which describes Improper Authorization, as well as aspects of CWE-749 related to Exposure of Sensitive Information to an Unauthorized Actor. In the context of the MITRE ATT&CK framework for mobile platforms, this vulnerability facilitates techniques associated with Data from Local System and potentially T1059 Command and Scripting Interpreter if further exploitation chains are developed through the accessed data. The attack path exemplifies how cross-application communication flaws can undermine the security posture of a device even when individual applications appear secure in isolation.
Mitigation for this issue primarily involves updating Google Chrome on Android devices to version 155.0.8059.39 or later, where these authorization checks have been corrected and hardened against such exploitation attempts. Users should ensure that automatic updates are enabled to receive security patches promptly as they become available. Additionally, organizations deploying mobile devices should enforce strict application whitelisting policies to minimize the risk of co-installed malicious apps gaining access through browser vulnerabilities. Security awareness training remains critical in this context, as social engineering is a prerequisite for triggering the vulnerability; therefore, educating users on recognizing suspicious PDF attachments and links can significantly reduce the attack surface even before technical patches are applied across all endpoints.