CVE-2026-106270: Google Chrome Auth Bypass Vulnerability

CVE-2026-106270 Overview

CVE-2026-106270 is an incorrect authorization vulnerability in the WebAppInstalls component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.39 and allows a remote attacker to spoof user interface elements through a crafted HTML page. Chromium's internal security severity rating for this issue is Low, while NVD assigns it medium severity. The vulnerability maps to [CWE-863: Incorrect Authorization] and requires user interaction to exploit. Successful exploitation can mislead users into trusting malicious content presented through spoofed browser UI, enabling downstream social engineering attacks such as phishing or unauthorized web app installation.

Critical Impact
A remote attacker can spoof browser UI elements through a crafted HTML page, enabling phishing and user deception attacks against users of Chrome versions prior to 155.0.8059.39.

Affected Products

Google Chrome versions prior to 155.0.8059.39 on desktop platforms
Chromium-based browsers that incorporate the vulnerable WebAppInstalls component
Progressive Web App (PWA) installation workflows exposed through affected Chrome builds

Discovery Timeline

2026-10-06 - CVE-2026-106270 published to NVD
2026-10-07 - Last updated in NVD database
2026-10-06 - Google Chrome Stable Channel update released addressing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-106270

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem, which handles installation of web applications and Progressive Web Apps. The component fails to correctly enforce authorization checks before rendering installation-related UI surfaces. An attacker who controls a malicious web page can leverage this gap to render UI elements that appear to originate from the browser rather than from untrusted web content. Users who trust these spoofed elements may approve actions, enter credentials, or install malicious web apps under false pretenses. The issue is classified as [CWE-863: Incorrect Authorization], indicating that authorization logic exists but is applied incorrectly.

Root Cause

The root cause is an authorization check in the WebAppInstalls flow that does not fully validate the origin or context of UI invocation requests. Web content can trigger browser-managed UI surfaces without the browser verifying that the requesting origin is authorized to influence their presentation. This confuses the trust boundary between browser chrome and page content, which is the foundation of modern web security models.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page in a vulnerable Chrome build. The attack vector is Network, attack complexity is Low, and no privileges are required, but user interaction is mandatory. The attacker crafts HTML that triggers the WebAppInstalls UI pathway and manipulates the rendered elements to impersonate legitimate browser prompts. Victims interacting with the spoofed interface may unknowingly authorize installation of attacker-controlled web applications or submit sensitive data. Public proof-of-concept code is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Technical details are tracked in Chromium Issue Tracker #553269860.

Detection Methods for CVE-2026-106270

Indicators of Compromise

Chrome browser versions reporting a User-Agent string earlier than 155.0.8059.39 across managed endpoints
Unexpected Progressive Web App installations appearing in user profiles without administrator provisioning
Browser telemetry showing navigation to untrusted domains immediately followed by web app install events

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 155.0.8059.39 for remediation
Correlate web proxy logs with endpoint PWA installation events to identify suspicious installation sources
Monitor for user reports of unusual browser prompts or installation dialogs appearing on untrusted sites

Monitoring Recommendations

Ingest Chrome update and version telemetry into a central logging platform for continuous version compliance checks
Alert on PWA installations originating from domains outside an approved allowlist
Review phishing report volume for mentions of unexpected Chrome install prompts, which may indicate active abuse

How to Mitigate CVE-2026-106270

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints
Enforce automatic Chrome updates through enterprise policy to prevent regression to vulnerable builds
Communicate awareness guidance to users regarding unexpected web app installation prompts and UI spoofing risks

Patch Information

Google has released a fixed build in the Chrome Stable channel. Administrators should deploy Chrome 155.0.8059.39 or later. Refer to the Google Chrome Stable Update advisory for full release details and the Chromium Issue Tracker #553269860 for the technical issue reference.

Workarounds

Disable or restrict Progressive Web App installation using the WebAppInstallForceList and DefaultWebAppInstallationForce enterprise policies until patching is complete
Apply strict web filtering to block access to unknown or low-reputation domains that could host crafted HTML payloads
Deliver targeted end-user training that reinforces caution around browser prompts triggered by untrusted sites

bash

# Example Chrome enterprise policy to block user-initiated web app installs on Linux
# Place in /etc/opt/chrome/policies/managed/web_app_install_policy.json
{
  "WebAppInstallForceList": [],
  "DefaultWebAppInstallationForce": false,
  "BlockExternalExtensions": true
}