CVE-2026-106262

Analyzed Analyzed - Analysis Complete

Incomplete cleanup in Chrome GetUserMedia allows UI spoofing

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106262

EUVD

EUVD-2026-93752

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This vulnerability involves incomplete cleanup in GetUserMedia in Google Chrome. A remote attacker who compromised the renderer process could use social engineering to trick users via a crafted HTML page, leading to UI element spoofing.

Detection Guidance

This vulnerability is specific to Google Chrome and cannot be directly detected via network or system commands. Ensure Chrome is updated to version 155.0.8059.39 or later to mitigate the issue.

Impact Analysis

An attacker could exploit this to trick you into thinking a malicious action is legitimate by spoofing UI elements. This might lead to unauthorized actions or data exposure if you interact with the spoofed interface.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. It involves a UI spoofing issue in Google Chrome due to incomplete cleanup in GetUserMedia, which is a security flaw but not a direct compliance violation.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-106262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70