CVE-2026-106216 Overview
CVE-2026-106216 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the ReadingList component of Google Chrome on Android. The flaw affects Chrome releases prior to version 155.0.8059.39. A remote attacker who successfully leverages social engineering can use a crafted HTML page to bypass web origin policy enforcement. Google rates the Chromium security severity as Medium. Exploitation requires the targeted user to visit attacker-controlled content, so the attack depends on user interaction rather than direct network access.
Critical Impact
A crafted HTML page can trigger unauthorized ReadingList state changes in the victim's Chrome profile, undermining the same-origin boundary that normally isolates web content.
Affected Products
- Google Chrome on Android prior to 155.0.8059.39
Discovery Timeline
- 2026-10-06 - CVE-2026-106216 published to the National Vulnerability Database (NVD)
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-106216
Vulnerability Analysis
The vulnerability resides in the ReadingList feature of Chrome on Android. ReadingList lets users save pages for later consumption and syncs entries through the browser profile. The implementation does not adequately enforce origin-based protections against forged requests. A malicious page can initiate state-changing operations against ReadingList endpoints without the user's intent. This bypasses the web origin policy, which is designed to prevent one origin from acting on behalf of another.
Root Cause
The root cause is missing or insufficient CSRF protection in the ReadingList request handling path [CWE-352]. The component accepts cross-origin requests that modify user state without verifying an unforgeable token, Fetch Metadata headers, or SameSite cookie constraints. The handler trusts ambient authority tied to the signed-in Chrome profile. See the Chromium Issue Tracker #518076654 for implementation detail.
Attack Vector
Exploitation starts with social engineering. The attacker lures a Chrome-on-Android user to a crafted HTML page. That page issues forged requests, through form submission or script, that target ReadingList functionality in the victim's browser. Because the browser attaches profile context automatically, the backend accepts the request as if the user initiated it. The attacker then manipulates ReadingList content outside the attacker's own origin.
No verified public proof-of-concept code is available. For technical specifics, consult the Google Chrome Stable Update advisory.
Detection Methods for CVE-2026-106216
Indicators of Compromise
- Unexpected modifications to a user's Chrome ReadingList entries without corresponding user activity.
- Mobile browser telemetry showing navigation to unfamiliar HTML pages immediately before ReadingList state changes.
- Outbound requests from Chrome on Android to domains hosting attacker-controlled HTML with embedded cross-origin form or fetch calls.
Detection Strategies
- Inspect mobile proxy or network logs for cross-origin POST requests targeting Chrome sync or ReadingList endpoints following visits to untrusted sites.
- Correlate Chrome version telemetry across managed Android fleets to identify devices running versions prior to 155.0.8059.39.
- Review phishing and smishing reports that direct users to HTML lures capable of invoking browser-internal features.
Monitoring Recommendations
- Enforce Chrome version reporting through mobile device management (MDM) to flag out-of-date installations.
- Monitor user-reported anomalies in saved reading content and sync state as a lightweight behavioral signal.
- Ingest browser and mobile endpoint telemetry into a centralized data lake to correlate web navigation with profile state changes.
How to Mitigate CVE-2026-106216
Immediate Actions Required
- Update Google Chrome on Android to version 155.0.8059.39 or later through the Google Play Store.
- Push the updated Chrome build to managed Android devices using MDM policy to shorten the exposure window.
- Warn users against opening unsolicited links received through SMS, messaging apps, or email on Android devices.
Patch Information
Google addressed CVE-2026-106216 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Install Chrome 155.0.8059.39 or newer on Android. Additional engineering detail is tracked in Chromium Issue Tracker #518076654.
Workarounds
- Restrict browsing on unpatched Android devices to trusted sites until the update is applied.
- Disable or avoid use of the ReadingList feature on affected Chrome builds where feasible.
- Apply enterprise browser policy to limit third-party cookies and cross-site request behavior on managed Android endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
