CVE-2026-106359 in Chrome
Summary
by MITRE • 10/07/2026
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as Confused Deputy within the DeviceBoundSessionCredentials component of Google Chrome prior to version 155.0.8059.39 represents a significant logical flaw in how browser credentials are associated with specific web origins. This issue stems from an improper restriction on resource access, where the application fails to correctly verify that the requesting entity is authorized to use the provided security context for its intended purpose. In this specific instance, the DeviceBoundSessionCredentials mechanism, which binds session tokens to physical devices or hardware identifiers to enhance authentication security, was susceptible to manipulation by a remote attacker. The core technical flaw lies in the failure of the browser's origin enforcement logic to properly isolate these credentials from unauthorized contexts, allowing them to be leveraged outside their intended scope without proper validation checks.
From an operational perspective, this vulnerability enables a remote attacker to bypass web origin policies through a crafted HTML page hosted on a malicious website or delivered via phishing campaigns. Web origin policies are fundamental security mechanisms that restrict how documents or scripts loaded from one origin can interact with resources from another origin. By exploiting the confused deputy condition in DeviceBoundSessionCredentials, an attacker could trick the browser into using valid session credentials associated with a different, legitimate origin to perform actions on behalf of the victim user. This effectively undermines the isolation guarantees provided by the same-origin policy, potentially allowing unauthorized access to sensitive web applications or data that should remain protected from cross-site interactions.
The classification of this vulnerability as CWE-269, Improper Privilege Management, highlights its nature as a failure in enforcing appropriate access controls within the application logic. Furthermore, it aligns with ATT&CK technique T1078, Valid Accounts, specifically under the sub-technique of utilizing legitimate credentials to gain unauthorized access or persistence. Although Chromium assigned this issue a low security severity rating, indicating that exploitation may require specific conditions or limited impact in many scenarios, the potential for origin policy bypass remains a critical concern for web application security. Attackers could potentially use this flaw to escalate privileges within a trusted session, leading to data exfiltration or unauthorized actions on behalf of the user without their knowledge.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these logical flaws in credential handling have been addressed by developers through stricter origin validation and improved isolation mechanisms for DeviceBoundSessionCredentials. For organizations relying on this browser environment, ensuring automated update policies are enforced is the most effective defense against exploitation of this specific vulnerability. Additionally, security teams should monitor for unusual patterns of cross-origin requests involving session tokens and implement strict Content Security Policy headers to limit the ability of external scripts or pages to interact with sensitive application resources. Regular audits of web application logic can also help identify similar confused deputy scenarios where resource access controls are not rigorously enforced against all potential requestors.