CVE-2026-106371 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the Transactions Platform of Google Chrome for Android, specifically in versions prior to 155.0.8059.39, represents a significant breach in access control mechanisms designed to protect sensitive user data. This security severity rating of Low by Chromium indicates that while the issue is exploitable and poses a risk to confidentiality, it may require specific conditions or limited scope for successful exploitation compared to critical privilege escalation vulnerabilities. The core technical flaw lies in the failure of the Transactions Platform to properly enforce authorization checks when handling requests related to financial transactions or payment-related data stored within the browser environment. In modern web browsers, platforms like this often interface with sensitive APIs that manage autofill information, saved credit cards, and transaction history. When an application fails to verify whether the requesting entity has legitimate permission to access specific resources, it creates a pathway for unauthorized data retrieval.
The operational impact of this vulnerability allows a remote attacker to obtain sensitive information through social engineering techniques rather than direct technical exploitation of network services. By crafting a malicious HTML page that leverages JavaScript APIs or embedded frames, an attacker can attempt to trigger actions within the Transactions Platform without proper user consent or verification. If successful, this could lead to the exfiltration of personally identifiable information such as saved payment credentials, transaction histories, or other financial details associated with the victim's Google account. The attack vector is classified as remote because it does not require physical access to the device but relies on the user visiting a compromised website or clicking a malicious link that hosts the crafted HTML payload. This highlights the persistent risk of cross-site scripting and improper API usage in web applications, where browser-side logic must be rigorously secured against manipulation by third-party scripts.
From an industry standards perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, the Missing Authorization check. These classifications underscore that the root cause is a logical error in how permissions are evaluated during runtime operations within the browser's sandboxed environment. Furthermore, from an offensive security standpoint such as the MITRE ATT&CK framework, this behavior relates to techniques involving client-side code execution and potentially data exfiltration via web-based vectors like T1059 or related sub-techniques for harvesting credentials through deceptive interfaces. The attacker effectively abuses the trust relationship between the browser engine and the user's sensitive data stores by bypassing intended access controls.
Mitigation strategies primarily involve updating to version 155.0.8059.39 or later, where Google has implemented stricter authorization checks within the Transactions Platform codebase. For organizations deploying Chrome on Android devices via mobile device management solutions, ensuring automatic updates are enabled is critical to maintaining this security posture. Additionally, users should be educated about the risks of visiting untrusted websites and interacting with prompts that request access to sensitive browser features. Security researchers and developers reviewing similar implementations in other applications should prioritize implementing least-privilege principles for all API endpoints handling financial data, ensuring that every request undergoes rigorous validation against user session tokens and permission scopes before processing any read or write operations on stored credentials.