CVE-2026-106188

Executive Summary

CVE-2026-106188 is a confused deputy vulnerability in the SignIn component of Google Chrome on Android, affecting versions prior to 155.0.8059.39. A remote attacker can bypass system access restrictions to reach a privileged page by luring a victim to a crafted HTML page. Successful exploitation permits a significant confidentiality impact (victim data exposure via privileged page access) with limited integrity impact, rated Medium by Chromium security severity and 7.1 by CVSS v3.1. No public proof-of-concept, exploit code, or in-the-wild exploitation has been observed, and no CISA KEV listing exists.

Technical Analysis

CWE-441 (Unintended Proxy or Intermediary, commonly termed "Confused Deputy") describes a scenario where a component with legitimate elevated privileges is manipulated by a less-privileged actor into misusing that authority on the actor's behalf. In this CVE, the vulnerable component is Chrome's SignIn flow on the Android platform. The "deputy" is the SignIn subsystem, which holds trusted, privileged access to an internal page or system-controlled surface — that access is intended to be reachable only through legitimate sign-in pathways. The attacker, who lacks that privilege, abuses the trust relationship by causing a crafted HTML page to route navigation or a request through the SignIn component so the privileged page is rendered or accessed in the attacker's context.

The essential mechanism of a confused deputy here is a check applied to the wrong principal or at the wrong boundary: the privileged page trusts requests arriving via SignIn, but the navigation that carries the request originates from attacker-controlled web content. Because privilege is granted based on which deputy is making the call rather than on who actually initiated it, the attacker effectively borrows the SignIn component's authority. The outcome defined by NVD is a bypass of system access restrictions into a privileged page — i.e., unauthorized reachability of an internal Chrome/Android page that should be gated from ordinary web origin content.

Two dimensions make this practically exploitable despite the modest Medium severity rating:

• Attack vector is network-based (AV:N) with no privileges required (PR:N). The attacker only needs to deliver a crafted HTML page, typifying a drive-by or link-based compromise.
• User interaction is required (UI:R) — the victim must visit the malicious page within Chrome on the affected Android build. No authentication or special app entitlement is needed beyond normal browsing.

The confidentiality impact is High (C:H), consistent with access to a privileged page potentially exposing sensitive system or account data; the integrity impact is Low (I:L), reflecting constrained ability to alter state through the privileged surface; availability impact is None (A:N). The scope is Unchanged (S:U), meaning the security authority of the vulnerable component is not considered to cross a defined trust boundary in the CVSS model — although the whole point of a confused deputy is that the attacker crosses an intended restriction, so operators should not read S:U as meaning the impact is trivial.

Technical detail caveat: The provided intelligence does not include function names, class names, URL endpoints, API paths, file paths, or parameter names for this CVE. The analysis above is therefore constrained to the vulnerability class (confused deputy / unintended intermediary) and the mechanism stated by NVD ("bypass system access restrictions into a privileged page via a crafted HTML page"). No specific internal method, IPC interface, or URI is asserted here because none is available in the source data.

Exploitation Scenarios

The following attack chain is described strictly at the vulnerability-class level. No public PoC exists for CVE-2026-106188, and the chain below is inferred from the confused deputy class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies users of Google Chrome on Android running a build older than 155.0.8059.39. Chrome on Android is extremely widely deployed; the target population is effectively any unpatched mobile Chrome user, so mass, opportunistic targeting is more plausible than surgical targeting. Reconnaissance is low-effort: publish attacker-controlled web content and await visits, or distribute links via phishing, malvertising, or compromised sites.

2. Triggering the Flaw. The victim is lured to a crafted HTML page. That page is constructed so that, when processed by the vulnerable SignIn component, it causes the privileged page to be reached through the SignIn intermediary instead of through the legitimate pathway. In confused deputy terms, the attacker induces the privileged component to act on the attacker's request. The exact HTML construct, triggering navigation, or intent mechanism is not disclosed in the available data and is deliberately not fabricated here.

3. Payload / Execution Method (vulnerability-class level). Execution is client-side and entirely browser-mediated. There is no need for the attacker to obtain code execution; the "execution" is the unauthorized navigation reaching the privileged page under the SignIn component's borrowed authority. Delivery is web-based (AV:N) and requires the victim's page visit (UI:R). Notably, this is a remote attack (AV:N) despite being triggered locally on the device.

4. Post-Exploitation Impact. As a result of reaching the privileged page, the attacker can potentially read or expose data that is normally gated behind the SignIn subsystem — hence the High confidentiality subscore. Because integrity is rated Low, the attacker's ability to mutate state through the bypass is presumed limited. Scope is Unchanged, meaning the direct victim is the Chrome/Android trust relationship on the affected device; however, exposure of sign-in-adjacent or account-linked data could have downstream consequences for the user's Google account and any service relying on that account context. Distinct from direct account takeover, the practical risk is information disclosure and bypass of a security boundary, not full code execution.

Impact Assessment

Business impact. The predominant impact is confidentiality loss through unauthorized access to a privileged page. For enterprise fleets, the primary concern is not direct data exfiltration from a corporate network but exposure of user-facing session/account data on managed Android devices that run Chrome. Where Android devices are enrolled in enterprise mobility management (EMM/MDM) and rely on Chrome's sign-in and profile isolation, a bypass of system access restrictions undermines the trust model those controls assume.

Affected systems. Google Chrome for Android versions prior to 155.0.8059.39. Desktop Chrome and other platforms are not indicated in the provided data. The blast radius is broad in raw terms because Chrome is ubiquitous on Android, but exploitation requires (a) an unpatched build and (b) a victim visiting attacker-controlled content.

CVSS subscores (v3.1, base 7.1).

• AV:N — deliverable over the network via a crafted page.
• AC:L — low attack complexity; no specialized conditions asserted.
• PR:N — no privileges required on the attacker side.
• UI:R — victim must visit the crafted page.
• S:U — scope unchanged in the CVSS model.
• C:H / I:L / A:N — High confidentiality, Low integrity, no availability.

Exploit likelihood. EPSS is 0.00222 (11.7th percentile) — low near-term exploitation probability. There is no known KEV listing, no public PoC, no Nuclei template, and no public exploit code. This indicates a latent, low-temperature risk today: severe in potential consequence for the confidentiality boundary but not currently weaponized in observed campaigns. Confidence in the patch state is 0/4 (unpatched per tracked sources), which is a material operational concern for defenders who cannot yet rely on a confirmed vendor fix mapping.

Detection Guidance

Detection here is inherently challenging because the exploit is a browser-side logic bypass delivered as ordinary HTML. Detection therefore centers on: (a) monitoring for Chrome version compliance, (b) network/URI heuristics around sign-in flows, and (c) device-level telemetry for unexpected privileged-page rendering. Because no concrete URI, function, or parameter is disclosed, the rules below are necessarily behavioral/version-oriented and should be tuned rather than deployed blindly. No fabricated indicators are used.

Sigma Rule

title: Suspicious Chrome Android SignIn Privileged Page Access (CVE-2026-106188)
id: 8f2c1d6a-4b7e-4c9a-9e2f-cve2026106188
status: experimental
description: Detects Chrome for Android builds below 155.0.8059.39 in use, the affected condition for CVE-2026-106188 (confused deputy in SignIn).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106188
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: android
detection:
  selection_browser:
    process.name|contains:
      - 'chrome'
      - 'com.android.chrome'
  selection_version_vulnerable:
    process.version|startswith:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      - '8'
      - '9'
      - '10'
      - '11'
      - '12'
      - '13'
      - '14'
      - '15'
  filter_fixed:
    process.version|startswith: '155.0.8059'
  condition: selection_browser and selection_version_vulnerable and not filter_fixed
falsepositives:
  - Chrome versions newer than 155.0.8059.39 not covered by the prefix filter; refine with full version comparison
level: low
tags:
  - attack.t1189
  - cve.2026-106188

YARA Rule

rule CVE_2026_106188_Chrome_Android_SignIn_Confused_Deputy
{
    meta:
        description = "Heuristic hunt for HTML pages targeting Chrome Android SignIn confused-deputy navigation (CVE-2026-106188). Behavioural only; no public PoC available."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106188"
        date = "2026-01-01"
        severity = "medium"
        confidence = "low"

    strings:
        $html = "<html" nocase ascii wide
        $intent1 = "intent://" nocase ascii
        $intent2 = "android.intent" nocase ascii
        $signin1 = "signin" nocase ascii wide
        $signin2 = "sign-in" nocase ascii wide
        $scheme1 = "chrome://" nocase ascii wide
        $scheme2 = "googlechrome://" nocase ascii

    condition:
        $html and (2 of ($signin*) ) and (1 of ($intent*) or 1 of ($scheme*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106188 Potential Chrome Android SignIn Confused Deputy Navigation"; flow:established,to_client; http.content_type; content:"text/html"; http.response_body; content:"signin"; nocase; http.response_body; content:"intent://"; nocase; distance:0; classtype:attempted-user; reference:cve,2026-106188; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-106188; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026106188; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where process.name : "chrome" and process.args : "*signin*"]
  [process where process.name : "chrome" and process.args : "*privileged*"]

Note: This EQL rule is behavioral and will produce false positives given the absence of concrete exploitation artifacts for CVE-2026-106188; it targets anomalous navigation within the Chrome process associated with sign-in. Tune the field mappings (e.g., process.args) to whatever Chrome navigation telemetry is available in your Android EDR pipeline, or adapt to DNS/URL field sets if you monitor network events instead.

Splunk SPL Query

index=proxy OR index=web OR index=chrome
| eval normalized_url = lower(url)
| where (like(normalized_url, "%signin%") OR like(normalized_url, "%sign-in%"))
        AND (like(normalized_url, "%intent://%") OR like(normalized_url, "%chrome://%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, url, user_agent
| where count > 0
| sort - count

This query hunts for the combination of a sign-in context and a privileged/intent navigation appearing in the same URL record — a behavioral proxy for the confused-deputy pattern. It is heuristic (low fidelity). Adjust index names and fields (url, dest_host, src_ip) to your schema; if your proxy logs don't capture chrome:// (device-internal) navigation, correlate instead with EDR browser telemetry.

Wazuh OSSEC Rule

<group name="chrome,cve-2026-106188,">
  <rule id="1061880" level="5">
    <decoded_as>json</decoded_as>
    <field name="process.name">chrome</field>
    <field name="process.version" negate="yes">^155\.0\.8059\.</field>
    <description>CVE-2026-106188: Chrome for Android detected below fixed version 155.0.8059.39 — potential confused deputy exposure in SignIn</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>vulnerability_detection,cve_2026_106188,</group>
  </rule>

  <rule id="1061881" level="10">
    <if_sid>1061880</if_sid>
    <field name="url">signin</field>
    <field name="url">intent://</field>
    <description>CVE-2026-106188: Suspicious SignIn navigation containing intent/privileged scheme on vulnerable Chrome for Android build</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_106188,exploitation_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). Treat the following as interim risk reduction, and independently verify the availability and applicability of the vendor release noted in the NVD description.

1) Immediate mitigations (until a verified vendor fix is confirmed on your fleet):

• Enforce browser version compliance. The NVD description states the issue is resolved in Chrome for Android 155.0.8059.39; inventory all managed Android devices and flag any Chrome build below 155.0.8059.39 for upgrade. Because patch confidence is 0/4, confirm the fix version directly with Google's Chrome release notes and Android app distribution channels rather than relying solely on this report.
• Enforce Chrome auto-update via EMM/MDM. For managed fleets, use enterprise policy to force app updates and prevent update deferral on Android.
• Restrict untrusted web content. Deploy web filtering / DNS-layer controls to reduce user exposure to attacker-controlled pages, since delivery hinges on the victim visiting crafted HTML. This lowers likelihood but does not eliminate the class of risk.
• Reduce sign-in exposure. Where operationally feasible, limit broad use of the in-browser sign-in surface on high-risk devices and ask users to remain within trusted sites.
• Awareness. Remind users not to follow unsolicited links; drive-by delivery is the primary vector (UI:R).

2) Patch / upgrade steps:

• Upgrade Google Chrome for Android to 155.0.8059.39 or later once the release is confirmed available in your region/Distribution channel (Google Play, managed Play, or approved enterprise app distribution).
• Validate the upgrade by confirming the app version on a representative sample of devices before fleet-wide rollout.
• Re-scan after rollout to confirm no devices remain below the fixed version.

3) Long-term hardening:

• Version baseline monitoring. Continuously detect and alert on browser versions below the known-good baseline (see the Sigma/Wazuh rules above) so future Chrome CVEs are caught by policy, not by manual review.
• Isolate browsing from sensitive sessions. Use enterprise browser management, managed profiles, or separate devices for privileged/sign-in activity so a browser-side bypass cannot bridge into high-value account context.
• Maintain a confused-deputy threat model for mobile browsers. Treat components that bridge web content and system-privileged pages (sign-in, intents, external handlers) as trust boundaries requiring separate review.
• Subscribe to Chromium security advisories and align an internal CBOM/app-inventory process to Chrome's release cadence.

References

1. NVD — CVE-2026-106188: https://nvd.nist.gov/vuln/detail/CVE-2026-106188
2. CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') — https://cwe.mitre.org/data/definitions/441.html
3. Google Chrome Releases (Android / stable channel advisories) — https://chromereleases.googleblog.com/
4. Google Chrome Security / Chromium severity guidelines (Medium rating context) — https://www.chromium.org/developers/severity-guidelines/
5. FIRST EPSS — CVE-2026-106188 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-106188

No threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-106188 as of this report; the CVE is not listed in CISA KEV, has no public PoC, no Nuclei template, and no known exploit code.