CVE-2026-106356 Overview
CVE-2026-106356 is a clickjacking vulnerability in the Extensions, Verifications, and Permissions (EVP) component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.39 and permits a remote attacker to spoof user interface elements through a crafted HTML page. Exploitation requires user interaction and social engineering, which places the attack in the user-assisted category of browser threats. The Chromium project classifies the issue at medium severity, and it is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames.
Critical Impact
Attackers can trick users into performing unintended actions by overlaying or disguising legitimate Chrome UI elements, potentially leading to unauthorized permission grants or sensitive data disclosure.
Affected Products
- Google Chrome versions prior to 155.0.8059.39
- Chromium-based browsers inheriting the vulnerable EVP component
- Desktop Stable channel builds across Windows, macOS, and Linux
Discovery Timeline
- 2026-10-06 - CVE-2026-106356 published to the National Vulnerability Database (NVD)
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-106356
Vulnerability Analysis
The vulnerability resides in Chrome's EVP subsystem, which handles rendering of browser-controlled UI surfaces such as permission prompts and verification dialogs. A crafted HTML page can manipulate layering and framing behavior to spoof these UI elements. The weakness aligns with CWE-1021, which covers improper restrictions on rendered UI layers and frames. Attackers rely on social engineering to lure users to a malicious page, where the spoofed interface induces clicks that the user believes are directed at legitimate controls.
Root Cause
The root cause is insufficient isolation between attacker-controlled page content and trusted browser UI surfaces rendered by the EVP component. When a crafted HTML page positions or styles elements over or adjacent to browser-controlled chrome, the user cannot reliably distinguish spoofed content from legitimate prompts. This design gap enables UI redress attacks against permission and verification workflows.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker hosts a crafted HTML page and uses phishing, malvertising, or deceptive links to lure victims. Once the page loads, overlay elements mimic or obscure legitimate Chrome UI. The user's click is captured by the attacker's content or redirected toward an action the user did not intend to approve, such as granting a sensitive permission.
No verified proof-of-concept code is published for this issue. Technical details are tracked in Chromium Issue #517090646 and the Chrome Stable Channel Update.
Detection Methods for CVE-2026-106356
Indicators of Compromise
- Browser telemetry showing navigation to unfamiliar domains immediately preceding sensitive permission grants (camera, microphone, geolocation, notifications).
- Web proxy logs containing HTML responses with heavy use of absolutely positioned overlays, transparent iframes, or pointer-events manipulation targeting Chrome UI regions.
- Chrome versions below 155.0.8059.39 reported by endpoint inventory tools.
Detection Strategies
- Inventory installed Chrome builds across managed endpoints and flag any version earlier than 155.0.8059.39.
- Correlate phishing email delivery with subsequent Chrome navigation events to attacker-controlled domains in SIEM data.
- Hunt for anomalous permission-grant events in Chrome Enterprise reporting that follow visits to newly observed or low-reputation domains.
Monitoring Recommendations
- Enable Chrome Enterprise Core and forward browser event logs to a centralized data lake for retention and query.
- Monitor DNS and web proxy logs for access to newly registered domains with HTML content serving overlay or iframe-heavy pages.
- Track help-desk tickets referencing unexpected browser prompts or UI inconsistencies as a leading indicator of social engineering campaigns.
How to Mitigate CVE-2026-106356
Immediate Actions Required
- Update Google Chrome to version 155.0.8059.39 or later on all managed endpoints.
- Restart Chrome after the update to ensure the patched binaries are loaded.
- Verify Chromium-based browsers in the environment have ingested the upstream fix.
Patch Information
Google addressed the issue in the Chrome Stable Channel release documented in the Chrome Releases blog. The fix is included in Chrome 155.0.8059.39 and later. Administrators managing Chrome through enterprise policy should confirm that the update channel is set to Stable and that automatic updates are not blocked.
Workarounds
- Enforce Chrome auto-update policies through Group Policy, MDM, or the Chrome Browser Cloud Management console.
- Deploy user-awareness guidance on recognizing suspicious prompts and avoiding clicks on unfamiliar overlays.
- Restrict access to newly registered or uncategorized domains at the secure web gateway until users are patched.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
