CVE-2026-106420

Analyzed Analyzed - Analysis Complete

Incorrect Calculation in API in Google Chrome on Windows

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106420

EUVD

EUVD-2026-93854

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability involves an incorrect calculation in Google Chrome's API on Windows systems before version 155.0.8059.39. It allows a remote attacker to trick users into installing a malicious Chrome extension that can then spoof UI elements, potentially deceiving users into taking harmful actions.

Detection Guidance

This vulnerability involves UI spoofing via a crafted Chrome extension due to incorrect API calculation. Detection requires checking installed Chrome extensions for untrusted or suspicious ones. Review extensions in chrome://extensions and look for unfamiliar or recently added items. No direct commands are provided in the CVE details.

Impact Analysis

This vulnerability could allow attackers to trick you into believing you are interacting with legitimate UI elements, such as fake login prompts or dialog boxes. This may lead to the theft of sensitive information like passwords or personal data if you enter it into these spoofed interfaces.

Compliance Impact

This vulnerability involves UI spoofing via a crafted Chrome extension, which could potentially deceive users into disclosing sensitive information. This could impact compliance with GDPR by risking unauthorized data exposure and HIPAA by compromising protected health information if exploited in healthcare contexts.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-106420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70