CVE-2026-106387 in Chrome
Summary
by MITRE • 10/07/2026
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization within the mobile version of Google Chrome on iOS prior to version 155.0.8059.39 represents a critical flaw in access control mechanisms that governs how web content interacts with browser features and user data. This security severity, classified as medium by Chromium standards, stems from an improper implementation of authorization checks when handling specific API calls or resource requests initiated by remote websites. In a properly secured environment, the browser should verify whether the origin of the request has explicit permission to access sensitive interfaces such as clipboard operations, geolocation services, or device identifiers. However, in this instance, the application failed to enforce these restrictions effectively, allowing any webpage loaded within the browser context to bypass standard authorization protocols without requiring user consent or validation.
The technical flaw centers on a logic error where the mobile rendering engine does not adequately isolate web content from privileged APIs when certain conditions are met. When a remote attacker crafts an HTML page containing malicious JavaScript code, they can exploit this gap by triggering specific functions that request sensitive information. Because the authorization check is either skipped or incorrectly evaluated, the browser proceeds to fulfill these requests as if they were legitimate and authorized actions initiated by the user. This bypass of security controls allows the executing script to read data that should remain private, such as clipboard contents containing passwords or authentication tokens, thereby compromising the confidentiality integrity of the user's session.
The operational impact of this vulnerability is significant due to its reliance on social engineering for exploitation. Since the attack vector requires a remote attacker to lure a victim into visiting a crafted HTML page, it falls under the category of phishing-based attacks where trust in the browsing experience is manipulated. Once the malicious page loads, the lack of authorization checks enables the extraction of sensitive information without any visible indicators or permission prompts that would typically alert the user to unauthorized access attempts. This can lead to credential theft, session hijacking, and further compromise of linked accounts if the stolen data includes authentication credentials or personal identifiable information stored in the clipboard or accessed through other exposed APIs.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically regarding the failure to enforce authorization policies for specific functions. It also maps closely to MITRE ATT&CK technique T1505.003, Server Software Component: Web Shell, in terms of persistence and data exfiltration methodologies, although more accurately it reflects T1005 Data from Local System where an adversary collects data directly from the local device through software components like a web browser. The exploitation method corresponds to ATT&CK tactic TA0006 Collection via techniques that involve harvesting information from the victim's environment using social engineering as the initial access vector, highlighting the importance of both technical controls and user awareness in mitigating such risks.
To mitigate this vulnerability, users are strongly advised to update Google Chrome on iOS to version 155.0.8059.39 or later immediately upon availability. This patch addresses the underlying authorization logic errors that allowed unauthorized access to sensitive browser features. In addition to updating software, organizations and individual users should implement strict content security policies within their own web applications if they host internal tools accessible via mobile browsers. Furthermore, enabling multi-factor authentication for all critical accounts reduces the impact of potential credential theft resulting from such exploits. Security awareness training remains essential to help users recognize social engineering attempts that may lead them to visit malicious pages designed to exploit browser vulnerabilities like this one.