CVE-2026-106264 Overview
CVE-2026-106264 is a missing authorization vulnerability in the Web Authentication (WebAuthn) component of Google Chrome, affecting the Passkeys and Security Keys workflow. The flaw exists in Chrome versions prior to 155.0.8059.39 and allows a remote attacker to spoof user interface elements through a crafted HTML page. Chromium's internal security triage rates the issue as Low severity, while the National Vulnerability Database (NVD) scores it in the Medium range. The weakness is tracked under CWE-862: Missing Authorization and requires user interaction to exploit.
Critical Impact
An attacker-controlled page can spoof WebAuthn UI elements, potentially tricking users into authorizing passkey or security key operations they did not intend.
Affected Products
- Google Chrome versions prior to 155.0.8059.39 (Desktop)
- Chromium-based browsers that incorporate the affected WebAuthn code paths
- Web Authentication component handling Passkeys and Security Keys
Discovery Timeline
- 2026-10-06 - CVE-2026-106264 published to the NVD
- 2026-10-07 - Last updated in NVD database
- 2026-10 - Google releases the Chrome Stable Channel desktop update addressing the issue (Chrome Desktop Update Announcement)
Technical Details for CVE-2026-106264
Vulnerability Analysis
The vulnerability resides in Chrome's Web Authentication implementation that handles Passkeys and hardware security keys. The browser fails to enforce proper authorization checks before rendering or interacting with WebAuthn-related UI surfaces. As a result, a remote attacker who serves a crafted HTML page can manipulate how those UI elements appear to the user. The flaw does not expose memory contents or enable code execution. Instead, it undermines the trust boundary that WebAuthn ceremonies rely on to confirm the user is interacting with a legitimate authenticator prompt. This maps to CWE-862: Missing Authorization and requires the victim to interact with the attacker's page.
Root Cause
The root cause is an authorization gap in the WebAuthn component. Chrome's code paths that drive passkey and security key dialogs do not sufficiently validate the originator or state before accepting input that influences their presentation. Without that check, content from an untrusted origin can influence UI elements that users expect to be controlled solely by the browser.
Attack Vector
Exploitation is network-based and requires the victim to visit or render a malicious page. The attacker crafts HTML that triggers the vulnerable WebAuthn flow and alters UI elements to mislead the user. A successful spoof can nudge a victim into completing a passkey or security key ceremony against an unexpected relying party, enabling downstream phishing or account-takeover scenarios. No elevated privileges are required on the attacker's side, and no credentials are needed to deliver the payload.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported for CVE-2026-106264. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are tracked in the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-106264
Indicators of Compromise
- Chrome Desktop clients reporting a version string below 155.0.8059.39 through inventory or user-agent telemetry.
- Unexpected WebAuthn registration or assertion events originating from unfamiliar relying party identifiers in authentication logs.
- User reports of passkey or security key prompts appearing on pages where authentication was not expected.
Detection Strategies
- Correlate browser version telemetry from endpoint inventory against the fixed build 155.0.8059.39 to identify exposed hosts.
- Review identity provider logs for WebAuthn ceremonies initiated from browser sessions tied to suspicious or newly registered domains.
- Hunt for web proxy events where users navigated to low-reputation domains immediately before an authentication event.
Monitoring Recommendations
- Monitor Chrome auto-update status across managed fleets and alert on clients that remain below the patched version.
- Track WebAuthn registration events in identity logs to detect anomalous enrollment of new authenticators.
- Enable URL filtering and phishing protection on web gateways to reduce exposure to crafted HTML delivery pages.
How to Mitigate CVE-2026-106264
Immediate Actions Required
- Update Google Chrome Desktop to version 155.0.8059.39 or later across all managed endpoints.
- Validate that Chrome auto-update is enabled and not blocked by enterprise policies or network restrictions.
- Communicate to users that WebAuthn prompts should only be approved on expected, verified sites.
Patch Information
Google addressed CVE-2026-106264 in the Chrome Stable Channel desktop release documented in the Chrome Desktop Update Announcement. Administrators should confirm deployment of Chrome 155.0.8059.39 or newer. Downstream Chromium-based browsers should be updated once their vendors incorporate the fix.
Workarounds
- Restrict browsing to trusted sites for users who perform high-value passkey operations until patching completes.
- Enforce phishing-resistant policies at the identity provider that bind authenticators strictly to approved relying party identifiers.
- Use enterprise browser management to force relaunch of Chrome after updates so the patched binary is active.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output: Google Chrome 155.0.8059.39 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.