CVE-2026-106391 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the WebShare API of Google Chrome on Android represents a significant breach in browser-level isolation mechanisms. This issue, resolved in version 155.0.8059.39 and classified with a medium security severity by Chromium, stems from insufficient access controls governing how web pages interact with native operating system features. Specifically, the flaw allows a remote attacker who has already achieved code execution within the renderer process to manipulate or spoof user interface elements that are typically managed by the browser shell or the underlying Android framework. This scenario highlights the critical importance of maintaining strict boundaries between untrusted web content and privileged application interfaces, as even partial compromise of the sandboxed environment can lead to broader security implications if internal APIs lack proper validation checks.
From a technical perspective, this vulnerability is rooted in CWE-269, which denotes Improper Privilege Management, specifically regarding the misuse of elevated privileges by lower-level processes. The WebShare API serves as an interface that allows web applications to invoke native sharing dialogs on mobile devices. When a renderer process executes malicious code via a crafted HTML page, it attempts to leverage this API to trigger UI components such as share sheets or notification prompts. Due to the authorization flaw, the browser fails to adequately verify whether the request originates from a legitimate context or if it is being spoofed by an attacker operating within the compromised sandbox. This lack of rigorous origin and privilege checking enables the renderer process to inject deceptive elements into the user interface, potentially mimicking system dialogs to trick users into performing unintended actions or revealing sensitive information.
The operational impact of this vulnerability centers on the potential for UI redressing attacks and social engineering exploits. By spoofing UI elements, an attacker can create a false sense of security or urgency, leading users to interact with malicious prompts that appear legitimate. For instance, a crafted page could display a fake system notification asking for permission to access contacts or location data, exploiting the user's trust in the browser's native interface. This undermines the integrity of the user experience and compromises confidentiality by facilitating phishing attacks that bypass traditional web-based security warnings. Although the attacker requires prior compromise of the renderer process, which typically involves an initial exploit such as a cross-site scripting vulnerability or a memory corruption flaw, the ability to spoof UI elements amplifies the severity of the initial breach by providing a direct vector for user deception and further data exfiltration.
In terms of industry standards mapping, this incident aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts or System Configuration Errors where attackers leverage existing system configurations to maintain access or escalate privileges. It also relates to T1204, User Execution, as the spoofed UI elements are designed to manipulate user behavior into executing further malicious actions. The flaw underscores the necessity for robust input validation and context verification in browser APIs that bridge web content with native operating systems. Mitigation strategies primarily involve applying the provided patch from Google Chrome version 155.0.8059.39 or later, which corrects the authorization logic to ensure that only trusted contexts can invoke specific UI components. Additionally, developers should implement strict Content Security Policy directives and avoid relying solely on browser-provided APIs for critical security decisions without additional verification layers. Users are advised to keep their browsers updated to benefit from these essential security fixes and remain vigilant against unexpected prompts or interface changes within web applications.