CVE-2026-106366 in Chrome
Summary
by MITRE • 10/07/2026
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incomplete cleanup issue within the CustomTabs component of Google Chrome for Android represents a significant breach in browser isolation mechanisms, specifically affecting versions prior to 155.0.8059.39. This flaw stems from improper state management during the lifecycle transitions of custom tabs, which are designed to allow applications to display web content without fully leaving the host app context. When a user navigates away or closes a custom tab session, certain internal resources and security contexts were not properly released or reset. This oversight creates a window where residual data or active sessions from one origin can persist in memory or be accessed by subsequent interactions that should have been isolated to a different origin. The severity of this issue is classified as high within the Chromium security framework due to its potential for widespread exploitation across Android devices running affected Chrome versions.
From a technical perspective, the core flaw lies in the failure to enforce strict separation between web origins during the teardown phase of custom tab sessions. Web browsers rely on the same-origin policy to prevent malicious scripts from accessing data associated with different domains, such as cookies, local storage, or DOM elements belonging to other sites. In this specific instance, the incomplete cleanup allows a crafted HTML page hosted by an attacker to exploit lingering state information. By carefully timing interactions and leveraging the residual context left behind after a custom tab session ends, an attacker can trick the browser into treating content from one origin as if it belongs to another. This effectively bypasses the same-origin policy, enabling cross-site scripting-like behaviors or unauthorized data access that should have been blocked by standard security controls.
The operational impact of this vulnerability is substantial for both end-users and enterprise environments relying on Chrome for Android. An attacker could potentially steal sensitive user information such as authentication tokens, session cookies, or personal data stored within the browser context if they can lure a victim into visiting a malicious webpage designed to exploit this state leakage. This bypass undermines the fundamental trust model of web browsing, where users expect that closing a tab or switching apps will fully isolate their activity from other websites. In enterprise settings, this could lead to credential theft and unauthorized access to corporate resources accessed via mobile browsers, posing risks to data confidentiality and integrity. The ability to bypass origin policies also facilitates more sophisticated phishing attacks where malicious content can masquerade as legitimate services by accessing restricted attributes or scripts.
Mitigation strategies primarily involve immediate software updates to address the root cause of the incomplete cleanup process. Users must upgrade Google Chrome on Android to version 155.0.8059.39 or later, which includes patches for this specific state management flaw within the CustomTabs component. For organizations deploying mobile devices, it is critical to enforce automated update policies through Mobile Device Management solutions to ensure all endpoints are patched promptly. Additionally, security awareness training should emphasize caution when interacting with custom tabs from untrusted sources, although technical remediation via patching remains the most effective defense. Monitoring for unusual network traffic or anomalous behavior in browser logs may also help detect exploitation attempts before significant damage occurs, though proactive patching is the primary recommended action to neutralize this high-severity vulnerability.