CVE-2026-106350 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the browser component of Google Chrome, specifically affecting versions prior to 155.0.8059.39, represents a significant breach in access control mechanisms that governs how sensitive data is handled during web interactions. This issue stems from a logic error or misconfiguration in the permission checks performed by the browser engine when processing requests initiated by remote content. The core technical flaw lies in the failure to properly validate whether the origin of an HTML page has sufficient privileges to access specific internal APIs, memory states, or configuration data that are intended for restricted use only by trusted contexts such as extensions or privileged pages. When a malicious actor crafts an HTML page designed to exploit this gap, they can bypass standard security boundaries and retrieve information that should remain confidential, effectively achieving unauthorized read access to sensitive browser internals.
From a technical perspective, this vulnerability is categorized under CWE-269, which denotes Improper Privilege Management, as it involves the execution of actions without proper authorization levels. The attack vector relies on social engineering or drive-by download tactics where an unsuspecting user visits a malicious website containing specially crafted HTML and JavaScript code. This code interacts with browser APIs in a way that triggers the flawed authorization logic, allowing the attacker to exfiltrate data such as cookies, session tokens, local storage contents, or potentially more sensitive information depending on the specific implementation details of the affected Chrome version. The severity is rated as Low by Chromium security standards because while it allows for information disclosure, it typically requires user interaction and does not provide direct code execution capabilities, limiting its immediate exploitability to data theft rather than full system compromise.
The operational impact of this vulnerability centers on privacy violations and potential credential theft. An attacker who successfully exploits this flaw can gain insights into a victim's browsing habits, active sessions, or stored credentials, which could be leveraged for further attacks such as session hijacking or targeted phishing campaigns. Although the browser isolates tabs to some extent, flaws in authorization logic within shared components like the network stack or storage managers can allow cross-origin data leakage if not properly sandboxed. This undermines the trust model of the web platform and exposes users to risks associated with identity theft and unauthorized access to personal accounts hosted on various websites.
Mitigation strategies primarily involve immediate software updates, as Google has released version 155.0.8059.39 which patches this authorization logic error by enforcing stricter checks before allowing data retrieval operations from untrusted origins. Administrators should ensure that all endpoints running Chrome are updated to the latest stable release to eliminate exposure to this flaw. In environments where immediate patching is not feasible, network-level controls such as web application firewalls can be configured to detect and block requests exhibiting patterns consistent with exploitation attempts against browser APIs. Additionally, users should exercise caution when visiting unfamiliar websites and consider using privacy-focused extensions that restrict API access or limit data sharing capabilities until the underlying vulnerability is resolved in their software environment.