CVE-2026-106394 in Chrome
Summary
by MITRE • 10/07/2026
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incomplete cleanup issue within the Glic component of Google Chrome prior to version 155.0.8059.39 represents a state management flaw that can lead to information disclosure across browser origins. This specific defect occurs when the application fails to properly reset or clear internal data structures after processing certain inputs, leaving residual artifacts in memory or session storage that persist beyond their intended lifecycle. The Glic component is responsible for handling various low-level input and configuration tasks within the Chromium engine, and its failure to sanitize state creates a window of opportunity for an attacker to exploit this lingering data during subsequent interactions with different web contexts.
The operational impact of this vulnerability centers on cross-origin data leakage, which violates the fundamental Same-Origin Policy that browsers enforce to isolate content from different sources. By leveraging social engineering techniques, such as tricking a user into visiting a maliciously crafted HTML page or clicking a deceptive link, an attacker can trigger specific actions within Chrome that interact with the compromised Glic component. Because the cleanup process was incomplete, sensitive data associated with one origin may remain accessible to another origin through subsequent API calls or DOM manipulations facilitated by the crafted webpage. This allows the remote attacker to exfiltrate information such as cookies, local storage contents, or other session-specific details that should have been isolated from unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and more broadly falls under CWE-613: Insufficient Session Expiration when considering the persistence of state data beyond its valid period. In terms of adversary behavior as defined by the MITRE ATT&CK framework, this exploit technique corresponds to T1530: Data from Local System or potentially T1005: Data from Local System depending on whether the leaked data is retrieved directly from memory or stored locally. The severity is rated as Low within the Chromium security model because it requires user interaction and social engineering rather than being a fully automated remote code execution vector, yet it remains significant due to its potential for stealthy data theft without triggering typical browser security alerts.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later where the incomplete cleanup logic in Glic has been corrected to ensure proper state reset after operations complete. For organizations unable to update immediately, implementing strict Content Security Policy headers can help mitigate some aspects of cross-origin data access by restricting how scripts interact with resources from different origins. Additionally, user education regarding social engineering tactics is critical since this vulnerability relies on the victim visiting a crafted page or interacting with malicious content designed to trigger the flawed state handling mechanism. Regular security audits and penetration testing focused on session management and memory safety in browser components can also help identify similar incomplete cleanup issues before they are exploited in production environments.