CVE-2026-106264

Analyzed Analyzed - Analysis Complete

Web Authentication UI Spoofing in Google Chrome

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106264

EUVD

EUVD-2026-93616

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authorization checks in Google Chrome's Web Authentication feature, which supports Passkeys and Security Keys. A remote attacker could exploit this by creating a crafted HTML page to spoof UI elements, potentially tricking users into unknowingly performing actions.

Detection Guidance

This vulnerability involves missing authorization in Web Authentication features in Google Chrome. Detection primarily requires checking the Chrome version installed on systems. If the version is prior to 155.0.8059.39, the system is vulnerable. No specific network commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to deceive you into interacting with fake UI elements. This might lead to unintended actions like approving unauthorized authentications or revealing sensitive information through misleading prompts.

Compliance Impact

This vulnerability involves missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome, which could allow a remote attacker to spoof UI elements. While the impact on compliance with standards like GDPR or HIPAA is not explicitly detailed, such UI spoofing could potentially lead to unauthorized access or misleading user interactions, posing risks to data integrity and user trust.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the missing authorization issue in Web Authentication.

Hi! I’m here to help you understand CVE-2026-106264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70