CVE-2026-106420: Google Chrome UI Spoofing Vulnerability

CVE-2026-106420 Overview

CVE-2026-106420 is a medium-severity vulnerability in Google Chrome on Windows affecting versions prior to 155.0.8059.39. The flaw stems from an incorrect calculation in a Chrome API that a remote attacker can abuse to spoof user interface (UI) elements. Exploitation requires user interaction and a crafted Chrome extension, which places this issue in the social engineering category. Google has shipped a fix in the Stable channel, and the Chromium project tracks the underlying defect as issue 477327257. The weakness maps to [CWE-682: Incorrect Calculation].

Critical Impact
An attacker who convinces a user to install a crafted extension can spoof trusted Chrome UI elements, enabling credential theft, phishing, and user-confusion attacks against the browser.

Affected Products

Google Chrome on Windows prior to 155.0.8059.39
Microsoft Windows (as the host platform for the vulnerable Chrome build)
Chromium-based browsers that inherit the affected API logic (verify with each vendor)

Discovery Timeline

2026-10-06 - CVE-2026-106420 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106420

Vulnerability Analysis

The vulnerability resides in a Chrome API that performs an incorrect calculation when determining how to render or position UI content requested by an extension. Because the calculation produces values that diverge from the browser's actual UI state, a crafted extension can draw content that visually overlaps or imitates trusted browser chrome. The attacker-controlled surface can mimic address bar hints, permission prompts, or security indicators without triggering standard warnings.

This is a user interface confusion issue, not a memory corruption bug. Confidentiality impact is limited to information the user discloses to the spoofed UI, and availability impact is similarly bounded. The flaw requires a user to install and interact with the malicious extension, which is why Chromium rated it Medium rather than High. The Chromium security team tracks the engineering details in issue 477327257.

Root Cause

The root cause is an arithmetic or boundary calculation error in the extension-facing API path. Classified under [CWE-682], the defect allows an extension to supply inputs that cause Chrome to compute incorrect geometry, state, or display parameters. The browser then renders UI based on those miscalculated values, breaking the trust boundary between extension-rendered content and browser-rendered chrome.

Attack Vector

Attack delivery relies on distributing a crafted Chrome extension and persuading the victim to install it on Windows. Once loaded, the extension invokes the affected API with inputs designed to trigger the miscalculation. The resulting spoofed UI can be used to phish credentials, misrepresent site identity, or coerce the user into granting elevated permissions. Network reachability of the attacker is sufficient because the extension payload can be hosted on any site or sideloaded through social engineering. No synthetic exploitation code is published for this issue; refer to the Chromium Issue Tracker #477327257 for engineering context.

Detection Methods for CVE-2026-106420

Indicators of Compromise

Chrome extensions installed from outside the Chrome Web Store or from recently created publisher accounts with low install counts.
Extensions declaring broad host_permissions or scripting permissions that are unnecessary for their stated purpose.
Endpoint reports of Chrome versions on Windows below 155.0.8059.39 still in production use.
User reports of unexpected prompts, duplicated address bars, or permission dialogs that reappear outside normal navigation.

Detection Strategies

Inventory installed Chrome extensions across managed Windows endpoints and flag any that are unlisted, sideloaded, or developer-mode installs.
Query browser version telemetry to identify hosts running Chrome builds earlier than 155.0.8059.39.
Correlate extension installation events with subsequent credential submission or OAuth consent activity to spot phishing follow-through.

Monitoring Recommendations

Enable Chrome Enterprise reporting and forward extension install, update, and permission-change events to the SIEM.
Monitor %LocalAppData%\Google\Chrome\User Data\Default\Extensions\ for new extension IDs on sensitive endpoints.
Alert on registry writes to HKLM\Software\Policies\Google\Chrome\ExtensionInstallForcelist that are not initiated by IT automation.

How to Mitigate CVE-2026-106420

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 155.0.8059.39 or later via the Stable channel.
Audit installed extensions and remove any that are untrusted, sideloaded, or unused.
Communicate to users that extension installation prompts and permission dialogs should be treated as high-trust decisions.

Patch Information

Google addressed CVE-2026-106420 in the Chrome Stable channel update documented in the Chrome Desktop Update News. Apply the vendor patch by rolling Chrome forward to 155.0.8059.39 or newer. Managed deployments should use Chrome Enterprise update policies to force the upgrade and verify compliance through browser version telemetry.

Workarounds

Restrict extension installation to an allowlist using the ExtensionInstallAllowlist Chrome policy until all endpoints are patched.
Disable developer mode extension loading on managed Windows devices via the DeveloperToolsAvailability policy.
Block execution of unsigned or unreviewed extensions through Chrome Enterprise policies.
Reinforce user awareness training on recognizing malicious extension install prompts.

bash

# Configuration example: Chrome extension allowlist via Windows registry
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f