CVE-2026-106311: Google Chrome Clickjacking Vulnerability

CVE-2026-106311 Overview

CVE-2026-106311 is a clickjacking vulnerability in the PermissionElement component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.39 and enables a remote attacker to spoof user interface elements through a crafted HTML page. Exploitation requires social engineering to convince the user to interact with the attacker-controlled page. The Chromium project classifies the severity as Medium, and the issue is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
An attacker can spoof permission prompts to trick users into granting access to sensitive browser capabilities such as camera, microphone, or geolocation.

Affected Products

Google Chrome Desktop (Stable channel) prior to 155.0.8059.39
Chromium-based browsers that embed the vulnerable PermissionElement implementation
Downstream distributions pulling the pre-patch Chromium release

Discovery Timeline

2026-10-06 - CVE-2026-106311 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106311

Vulnerability Analysis

The vulnerability resides in the PermissionElement interface, a Chrome component that renders in-page permission request controls. The implementation does not sufficiently restrict how the element can be visually overlaid, resized, or composited with surrounding page content. An attacker who controls page markup can position opaque or transparent layers near the permission control to disguise its purpose. The user believes they are clicking a benign element and instead approves a sensitive browser permission.

User interaction is required, and the attack is delivered over the network through a malicious or compromised web page. The impact is limited to the browser context, affecting confidentiality and availability of browser-mediated resources rather than the underlying operating system.

Root Cause

The root cause is improper restriction of rendered UI layers around the PermissionElement, which falls under CWE-1021. The element did not enforce sufficient visibility, occlusion, or geometry checks before accepting activation input, allowing adjacent DOM content to spoof the prompt.

Attack Vector

An attacker hosts a crafted HTML page that renders a PermissionElement alongside deceptive overlays, misleading text, or disguised controls. The attacker lures the victim to the page through phishing, malvertising, or a compromised site. When the victim clicks what appears to be an unrelated UI element, the click activates the permission prompt and grants the requested capability. No authentication or elevated privileges are required on the attacker side.

No public proof-of-concept exploit is listed for this CVE at the time of publication. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-106311

Indicators of Compromise

Browser telemetry showing permission grants (camera, microphone, geolocation, notifications) immediately after navigation to a low-reputation domain
Chrome version strings below 155.0.8059.39 reported by enterprise inventory tooling
User reports of unexpected permission prompts or UI elements appearing on untrusted pages

Detection Strategies

Inventory installed Chrome builds across managed endpoints and flag any instance earlier than 155.0.8059.39
Correlate web proxy logs with permission-grant events to identify suspicious domains triggering sensitive capability requests
Monitor browser extension and policy logs for anomalous PermissionElement interactions on newly visited sites

Monitoring Recommendations

Ingest Chrome enterprise reporting events into a central SIEM for permission-grant visibility
Alert on navigation to newly registered or uncategorized domains that subsequently request privileged browser APIs
Track user-reported phishing submissions that reference fake permission dialogs or overlay-based social engineering

How to Mitigate CVE-2026-106311

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all managed endpoints
Force a browser restart through enterprise management to ensure the patched binaries are loaded
Validate Chromium-based third-party browsers for vendor-supplied patches aligned with the upstream fix

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Chrome Stable Update advisory. The fix lands in Chrome 155.0.8059.39 for Desktop. Administrators managing fleet deployments should push the update through Group Policy, Chrome Browser Cloud Management, or their preferred software distribution tool.

Workarounds

Restrict high-risk browsing through URL filtering until all endpoints are patched
Deploy enterprise policies that disable sensitive permissions (camera, microphone, geolocation) by default and require administrative approval
Reinforce user awareness training focused on unexpected permission prompts and overlay-based social engineering

bash

# Example Chrome enterprise policy to restrict sensitive permissions by default
# Linux policy path: /etc/opt/chrome/policies/managed/permissions.json
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false
}