CVE-2026-106363 in Chrome
Summary
by MITRE • 10/07/2026
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Google Chrome prior to version 155.0.8059.39 represents a critical failure in authorization controls within the FullScreen API implementation. This flaw allows an attacker who has already achieved code execution within a renderer process, typically through a separate security breach or exploit chain, to escalate privileges and bypass system-level access restrictions. The core technical issue stems from insufficient validation of user intent when transitioning into full-screen mode. In modern web browsers, the FullScreen API is designed to provide a distraction-free viewing experience by hiding browser UI elements such as address bars and navigation controls. However, this transition requires explicit user interaction or permission in many contexts to prevent malicious sites from hijacking the display for phishing or other deceptive purposes. The vulnerability arises because the browser failed to properly verify that the request to enter full-screen mode was authorized by a legitimate user action rather than being triggered programmatically by compromised script code without appropriate consent mechanisms.
From an operational perspective, this flaw enables remote attackers to leverage social engineering tactics in conjunction with technical exploitation. An attacker might host a crafted HTML page on a malicious website or inject it into a vulnerable application via cross-site scripting if other defenses are bypassed. When a victim interacts with the page under deceptive pretenses, such as believing they are clicking a legitimate button or link, the browser may inadvertently grant full-screen privileges to the malicious content. Once in full-screen mode, the attacker gains significant control over the user's visual field and input focus. This state can be used to overlay fake login prompts, capture keystrokes more effectively by obscuring security indicators like HTTPS lock icons, or prevent the user from easily closing the tab using standard keyboard shortcuts that are often disabled during full-screen execution. The severity is classified as medium because while it does not allow direct kernel-level compromise, it significantly enhances the effectiveness of subsequent attacks and undermines trust in the browser's interface integrity.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, specifically where a process or user gains privileges that are not explicitly granted by an authorized action. It also relates to CWE-830, involving inclusion of functionality from incorrect source, if the full-screen state is triggered via untrusted input without proper validation. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1566.002, which covers Spearphishing Links leading to drive-by compromises or social engineering attacks that manipulate user interface elements. The exploitation path typically involves an initial entry point such as a compromised renderer process, followed by the abuse of browser APIs to achieve persistence and evasion. This highlights the importance of strict separation between untrusted web content and privileged system operations like display management.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these authorization checks have been reinforced. For organizations unable to patch immediately, implementing Content Security Policy directives can help restrict the execution of scripts that attempt to manipulate full-screen states without user gestures. Additionally, deploying browser extensions or security gateways that monitor for unusual API usage patterns may provide an additional layer of defense against such exploitation attempts. Users should remain vigilant regarding social engineering tactics and avoid interacting with unexpected prompts on untrusted websites. Regularly updating browsers ensures that known flaws in privilege escalation mechanisms are addressed before they can be leveraged by threat actors to bypass security boundaries established within the browser sandbox architecture.