CVE-2026-106404 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within Google Chrome's FontAccess component represents a significant breach in browser sandboxing integrity, specifically affecting versions prior to 155.0.8059.39. This issue stems from a failure in the access control mechanisms that govern how web content interacts with system-level resources, particularly those related to font rendering and enumeration. In modern browsers like Chrome, security is heavily reliant on process isolation, where renderer processes are confined within strict sandboxes to prevent malicious code from accessing sensitive host system data or executing arbitrary commands. The FontAccess API serves as a bridge between the web environment and local system fonts, allowing websites to query available font families for styling purposes. However, in this specific instance, the implementation failed to properly validate whether the requesting context possessed the necessary privileges to access these restricted resources when operating from within a compromised renderer process.
From a technical perspective, the core flaw lies in the insufficient verification of authorization tokens or permissions during the invocation of FontAccess functions by untrusted web content. When an attacker crafts a malicious HTML page designed to exploit this weakness, they can trick the browser into granting access to system fonts that should remain isolated from the renderer process. This bypass is particularly dangerous because it undermines the fundamental assumption that compromised renderers are harmless due to their limited scope of interaction with the host operating system. By leveraging this flaw, an attacker who has already achieved code execution within a sandboxed tab can escalate privileges by accessing local font files or metadata that may contain sensitive information about the user's installed software, personalization settings, or even proprietary assets embedded in those fonts.
The operational impact of this vulnerability is categorized as medium severity because it requires initial compromise of the renderer process, which typically implies some form of prior exploitation such as a cross-site scripting attack or a drive-by download that bypassed other security controls like site isolation and content security policies. Nevertheless, once inside the renderer, the ability to access system fonts expands the attacker's reconnaissance capabilities significantly. This can facilitate further attacks by revealing details about the victim's environment, potentially aiding in crafting more targeted exploits against specific applications known to be installed based on font presence. Furthermore, accessing local resources without proper authorization violates the principle of least privilege and erodes trust in the browser's security model, making it easier for attackers to maintain persistence or exfiltrate data through side-channel attacks that rely on timing differences caused by font loading operations.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as the application failed to enforce appropriate access controls when granting elevated permissions to a potentially untrusted context. Additionally, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, in scenarios where font enumeration is used to gather intelligence for subsequent scripting activities, although its primary classification remains within unauthorized resource access rather than direct command execution. The mitigation strategy involves upgrading Google Chrome to version 155.0.8059.39 or later, which includes patches that enforce stricter authorization checks before allowing renderer processes to interact with the FontAccess API. Organizations should ensure automatic updates are enabled for all endpoints running this browser and monitor for any indicators of compromise related to unusual font access patterns in network logs or endpoint detection systems.