CVE-2026-106400 in Chrome
Summary
by MITRE • 10/07/2026
Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as clickjacking within the Messages interface of Google Chrome on Android represents a significant user interface manipulation flaw that exploits the browser's rendering engine and frame embedding capabilities. This issue, present in versions prior to 155.0.8059.39, allows an attacker to construct malicious HTML pages designed to overlay invisible or semi-transparent frames over legitimate web content. By leveraging social engineering techniques, such as deceptive links or embedded ads on compromised websites, the attacker can trick users into interacting with UI elements that appear to belong to a trusted application but are actually controlled by the malicious page. The core technical flaw lies in the insufficient enforcement of frame-busting scripts and the lack of robust X-Frame-Options headers within specific contexts handled by Chrome for Android, particularly when dealing with third-party content or embedded services like Messages. This misconfiguration permits the browser to render external pages inside frames without adequate restrictions, thereby enabling the overlay attack vector where user clicks intended for one element are intercepted and redirected to another target controlled by the attacker.
From a technical perspective, this vulnerability falls under the category of UI redressing attacks, specifically classified as CWE-1021: Improper Restriction of Rendered UI Layers or Frames in OWASP Top 10 terms, and is mapped to MITRE ATT&CK technique T1657: Hijack Execution Flow via Clickjacking. The operational impact stems from the ability to perform unauthorized actions on behalf of the user without their explicit consent. For instance, an attacker could disguise a malicious button over a legitimate login field or transaction confirmation screen within the Messages interface. When the victim clicks what they believe is a safe element, such as dismissing a notification or reading a message, the click event is captured by the hidden frame above it. This can lead to account takeover if authentication tokens are exposed through subsequent interactions, unauthorized financial transactions in integrated payment services, or the execution of malicious scripts that compromise device security further. The severity is rated as medium because while it requires user interaction and social engineering, the potential for data exfiltration and identity theft makes it a critical concern for mobile users who frequently engage with sensitive communications via browser-based interfaces.
Mitigation strategies primarily involve both client-side updates and server-side hardening measures. For end-users, the most effective immediate action is to update Google Chrome on Android to version 155.0.8059.39 or later, where Chromium has implemented stricter frame embedding policies and enhanced clickjacking protections specifically for mobile contexts. Developers integrating third-party content into web applications must ensure that they implement robust security headers such as X-Frame-Options set to DENY or SAMEORIGIN, along with Content-Security-Policy directives like frame-ancestors 'self' to prevent their pages from being embedded in frames on unauthorized domains. Additionally, employing JavaScript-based clickjacking protection scripts can provide an additional layer of defense by detecting if the page is loaded within a frame and breaking out of it immediately. Security awareness training for users remains crucial, as technical controls cannot fully mitigate risks associated with sophisticated social engineering campaigns that exploit trust in familiar interfaces like messaging platforms.