CVE-2026-106422 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization issue within the application programming interface of Google Chrome, specifically in versions prior to 155.0.8059.39, represents a significant deviation from expected access control mechanisms. This flaw allows for the bypassing of web origin policies through the exploitation of crafted HTML pages hosted by remote attackers. The core technical deficiency lies in the failure of the browser's security model to properly validate the source and intent of requests originating from untrusted contexts against privileged internal interfaces or APIs. When a malicious webpage is constructed with specific parameters designed to trigger this authorization logic error, it can execute actions that should be restricted to same-origin scripts or higher-privilege contexts. This bypass effectively undermines the isolation guarantees provided by the browser's sandboxing architecture, enabling cross-site scripting-like effects where data from one origin can be accessed or manipulated by another without proper consent or security checks.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, and more specifically relates to issues found under CWE-862 regarding Missing Authorization Checks within the API layer of the browser engine. The attack vector is classified as remote because it requires no local access or user interaction beyond visiting a maliciously crafted website. This aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly when such bypasses are leveraged to execute further scripts within the context of the victim's browser session. The severity is rated as low by Chromium security standards because while it allows for policy bypass, the practical exploitation often requires specific conditions or limited payloads compared to critical memory corruption vulnerabilities. However, even low-severity issues can be chained with other weaknesses to create more severe attack scenarios involving data exfiltration or session hijacking if additional vectors are present in the user's environment.
The operational impact of this vulnerability centers on the potential compromise of web application integrity and user privacy. By bypassing origin policies, an attacker could potentially access sensitive information stored within cookies, local storage, or IndexedDB that is scoped to a different domain than the malicious page. This can lead to unauthorized data retrieval, manipulation of stateful interactions with web services, or even phishing attacks where the victim's browser context is used to make requests that appear legitimate due to the successful origin bypass. While the immediate impact may be limited by modern browser mitigations such as same-site cookie attributes and content security policies, the existence of this flaw indicates a weakness in the fundamental trust boundaries between different web origins. It highlights the risk associated with complex API implementations where authorization checks might not account for all edge cases or crafted input sequences designed to confuse the validation logic.
To mitigate the risks associated with this vulnerability, it is imperative that users and organizations update Google Chrome to version 155.0.8059.39 or later immediately upon availability. This patch addresses the underlying authorization checks within the API layer, ensuring that requests from untrusted origins are properly rejected when they attempt to access restricted resources. For developers integrating web technologies with browser-specific APIs, it is crucial to implement robust input validation and ensure that all privilege escalations are explicitly checked against current security policies rather than relying on implicit assumptions about context safety. Additionally, deploying content security policy headers can provide an additional layer of defense by restricting the sources from which scripts and other resources can be loaded, thereby reducing the effectiveness of any remaining exploitation attempts even if similar vulnerabilities exist in future browser versions. Regular auditing of web application code against standards like OWASP Top 10 is also recommended to identify and remediate authorization flaws before they can be exploited in production environments.