CVE-2026-106367 in Chrome
Summary
by MITRE • 10/07/2026
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization in Google Chrome for Android prior to version 155.0.8059.39 represents a critical failure in access control mechanisms within the mobile browser environment. This flaw specifically affects the interaction between the Chromium-based web engine and co-installed applications on the device. The core technical issue lies in the insufficient validation of permissions when Chrome attempts to communicate with or launch other installed Android packages. In a properly secured system, any inter-process communication or intent firing from a privileged component like a browser must strictly verify that the calling context has explicit authorization to perform the action and target the specific destination application. However, due to this oversight, the browser fails to enforce these necessary checks, effectively allowing any co-installed app with appropriate permissions to trigger actions within Chrome without proper authentication or user consent mechanisms being fully engaged for that specific interaction vector.
The operational impact of this vulnerability is significant because it enables a local attacker who has already gained access to an application installed on the same device to potentially execute arbitrary code outside the browser's sandboxed environment. The attack scenario typically involves social engineering, where the victim is tricked into installing or interacting with a malicious co-installed app. Once such an app is present, it can exploit the missing authorization check by sending specially crafted intents to Chrome. Because Chrome does not adequately verify whether this external request should be permitted, the browser may execute code in a context that bypasses standard security boundaries. This escape from the sandbox allows the attacker to access sensitive data stored within the browser profile, such as cookies, saved passwords, and browsing history, or potentially install further malware with elevated privileges derived from the compromised session state.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, specifically regarding the failure to enforce access control policies for inter-process communication. It also relates to CWE-749, where an application exposes dangerous functionality to unauthorized actors who do not have explicit permission to use it. In terms of offensive security frameworks like MITRE ATT&CK Mobile, this behavior is consistent with techniques involving Application Interception and Component Reuse, where a malicious app leverages the trust relationship between components on the device to escalate privileges or move laterally within the system boundaries. The medium severity rating assigned by Chromium reflects that while exploitation requires user interaction through social engineering and prior installation of a companion app, the resulting impact includes potential full compromise of browser-based identity and data confidentiality.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome on Android devices to version 155.0.8059.39 or later, where these authorization checks have been reinforced by the Chromium security team. Users should ensure that automatic updates are enabled to receive patches promptly as they become available. Additionally, from a defensive posture perspective, users and organizations should enforce strict application installation policies on managed devices, limiting the ability of untrusted applications to coexist with critical system components like browsers. Security awareness training is also crucial to mitigate the social engineering aspect of this attack vector, ensuring that end-users are cautious about installing apps from unknown sources or those requesting excessive permissions relative to their stated functionality. Regular auditing of installed applications and removal of unused or suspicious packages can further reduce the attack surface available for such local privilege escalation attempts.