CVE-2026-106420 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect calculation within the application programming interface of Google Chrome on Windows systems prior to version 155.0.8059.39 represents a significant risk related to user interface spoofing and trust boundary violations. This flaw stems from a logical error in how the browser processes specific inputs or state changes associated with extensions, leading to miscalculations that affect the rendering or behavior of UI elements. The core technical issue lies in the failure of the internal logic to correctly validate or bound certain parameters during extension execution, which allows an attacker to manipulate the visual presentation and functional context presented to the end user. This type of vulnerability is categorized under CWE-840, which describes incorrect calculation of boundary conditions, as well as CWE-20, improper input validation, where the system fails to adequately check inputs before processing them in a way that affects security-critical functions like UI rendering and extension permissions.
The operational impact of this flaw centers on the potential for social engineering attacks facilitated by crafted Chrome extensions. Because the vulnerability allows for the spoofing of user interface elements, an attacker can create malicious extensions designed to mimic legitimate browser components or trusted websites. By leveraging these spoofed interfaces, a remote attacker can deceive users into performing actions they would not otherwise take, such as entering credentials on a fake login page that appears indistinguishable from the actual Google Chrome UI or a trusted service. This undermines the fundamental trust model of the web browser, where users rely on visual cues and address bar indicators to verify authenticity. The severity is rated as medium by Chromium security standards because while it requires user interaction through social engineering, its effectiveness in bypassing traditional phishing defenses makes it particularly dangerous for high-value targets or organizations with less security-aware personnel.
This vulnerability aligns closely with the MITRE ATT&CK framework technique T1078, Valid Accounts, and more specifically relates to UI redressing attacks often associated with T1621, Hide Active Operations, where malicious actors obscure their true intent by overlaying deceptive interfaces over legitimate ones. The exploitation path typically involves distributing a seemingly benign or useful extension that contains the flawed code triggering the incorrect calculation. Once installed, the extension can intercept navigation events or modify DOM elements to present false information, effectively creating a man-in-the-browser scenario without requiring direct network interception. This allows the attacker to harvest sensitive data such as session cookies, passwords, or two-factor authentication codes by presenting fake prompts that appear to originate from the browser itself rather than an external site.
Mitigation strategies for this vulnerability primarily involve immediate software updates and strict extension management policies. Users must upgrade Google Chrome to version 155.0.8059.39 or later, where the incorrect calculation logic has been corrected to properly validate inputs and enforce boundary conditions during UI rendering processes. In enterprise environments, it is critical to restrict the installation of extensions to only those vetted by IT administrators through managed install policies. This prevents users from inadvertently installing malicious or unverified extensions that could exploit this flaw. Additionally, security awareness training should emphasize verifying URL authenticity and looking for subtle discrepancies in interface design, as social engineering remains the primary vector for exploitation. Regular auditing of installed extensions and disabling unnecessary ones reduces the attack surface available to adversaries seeking to leverage UI spoofing techniques against organizational assets.