CVE-2026-106360 in Chrome
Summary
by MITRE • 10/07/2026
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an information leak within the payment processing subsystem of Google Chrome, specifically affecting versions prior to 155.0.8059.39, represents a significant breach in cross-origin isolation principles. This flaw allows a remote attacker to access sensitive data belonging to other origins through a maliciously crafted HTML page. The core technical issue stems from an improper handling of state or memory during the execution of payment-related APIs, where the browser fails to adequately segregate context between different web pages. When a user interacts with a legitimate e-commerce site that utilizes Chrome's built-in payment infrastructure, internal objects or responses containing sensitive financial details may remain accessible in memory or DOM structures without proper sanitization. An attacker can exploit this by hosting a webpage designed to trigger specific JavaScript events or API calls within the context of the victim’s session, effectively bypassing same-origin policies and reading data that should be strictly confined to the payment origin.
From an operational perspective, this vulnerability poses severe risks to user privacy and financial security. By obtaining cross-origin data, an attacker can potentially harvest sensitive information such as credit card numbers, billing addresses, or authentication tokens associated with a victim’s active shopping session. This capability undermines the fundamental trust model of web browsers, where users expect that content from one origin cannot interfere with or read data from another unrelated origin. The exploitation does not require physical access to the target machine and can be executed remotely via social engineering tactics, such as luring victims into visiting a compromised website or clicking on a malicious link. The medium severity rating assigned by Chromium reflects the potential for significant harm while acknowledging that successful exploitation may depend on specific browser configurations or user interactions, yet it remains critical enough to warrant immediate attention due to the high value of financial data targeted.
This vulnerability aligns with CWE-200, which classifies information exposure as a category where sensitive information is disclosed to unauthorized actors without explicit intent. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Data from Local System or Browser-based Credential Access, specifically leveraging browser vulnerabilities to exfiltrate data that would otherwise be protected by sandboxing mechanisms. The attack vector relies on the attacker crafting a webpage that exploits the race conditions or state management flaws within the payment API implementation, allowing for unauthorized read access across origin boundaries. Such flaws often arise from complex interactions between multiple JavaScript engines and native code components handling sensitive inputs, where error handling paths may inadvertently expose internal states to scriptable contexts.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, which contains the necessary patches to enforce stricter origin checks and sanitize data returned by payment APIs. For organizations managing enterprise deployments of Chromium-based browsers, ensuring automatic update policies are enforced is crucial to prevent exposure across user endpoints. Additionally, users should maintain up-to-date security software that can detect malicious scripts attempting to exploit browser vulnerabilities. Developers integrating third-party payment solutions should also audit their implementations for any reliance on deprecated or insecure API calls and ensure they adhere to modern web standards like Content Security Policy (CSP) directives that restrict data flow and execution contexts. Continuous monitoring of browser update notifications from Google is essential, as these patches are frequently released in response to discovered flaws that could compromise user data integrity and confidentiality.