CVE-2026-106280
Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Google Chrome

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Chrome

Description
Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-09
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-106280
EUVD
EUVD-2026-93723

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google chrome to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect authorization in PermissionElement in Google Chrome before version 155.0.8059.39. A remote attacker could exploit this by crafting an HTML page to bypass web origin policy, potentially gaining unauthorized access to resources or data.

Detection Guidance

This vulnerability is specific to Google Chrome versions prior to 155.0.8059.39. Detection involves checking the installed Chrome version. On Windows, run: wmic product where name='Google Chrome' get version. On Linux, run: google-chrome --version. If the version is below 155.0.8059.39, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass security restrictions, access sensitive data, or perform actions on behalf of users without proper authorization. Users of affected Chrome versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must ensure patched versions are deployed to maintain compliance.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the incorrect authorization issue in PermissionElement.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart