CVE-2026-106210

Executive Summary

CVE-2026-106210 is a medium-severity information disclosure vulnerability in Google Chrome, affecting all versions prior to 155.0.8059.39. The flaw is classified as an observable discrepancy (CWE-203) in the Scroll component, enabling a remote attacker to obtain cross-origin data via a crafted Chrome extension. Because the attack requires the victim to install or interact with a malicious extension, the practical impact is scoped to users who load untrusted extensions, but any such user may expose data belonging to other origins they visit.

Technical Analysis

The vulnerability resides in Chrome's Scroll subsystem — the browser component responsible for scroll positioning, scroll anchoring, and scroll-related rendering events exposed to web content and extensions. The NVD description attributes the flaw to an observable discrepancy (CWE-203), meaning the vulnerable code produces a behavior that differs in a measurable, observable way depending on conditions the attacker should not be able to distinguish (for example, the presence, layout state, or content characteristics of a cross-origin document).

The attack surface is the Chrome extension platform. A crafted extension is the stated vector. This is significant: Chrome extensions run with privileged API access and, under the Chromium extension security model, are expected to respect origin boundaries unless explicitly granted host permissions. The observable discrepancy allows a crafted extension to infer cross-origin data — i.e., to learn facts about documents belonging to origins the extension should not be able to read. This class of bug is commonly referred to as cross-origin leak / XS-Leak style information disclosure, where timing, size, or state differences observable from a privileged context reveal bits of cross-origin state.

Two elements must be stated clearly given the limited advisory data:

1. Insufficient technical detail available. The NVD description does not disclose the specific scroll property, event, API surface, or measurement channel that produces the discrepancy. No function names, parameters, or code paths are provided and none should be assumed.
2. The mechanism is inferable only at the class level. CWE-203 → an attacker-controllable observation (from extension context) correlates with a protected cross-origin condition, and the scroll subsystem's observable behavior differs across that condition, leaking information.

The Chromium security severity rating is Medium, consistent with an information-disclosure bug that requires a crafted extension and yields data leakage (confidentiality impact) without direct code execution, privilege escalation, or integrity/availability impact.

Exploitation Scenarios

No public PoC is available for CVE-2026-106210. The attack chain below is inferred strictly from the vulnerability class (CWE-203 observable discrepancy) and the stated vector (crafted Chrome extension). No specific function names, endpoints, or parameters are asserted because none are present in the source data.

1. Reconnaissance / target identification. The attacker identifies a target running Chrome prior to 155.0.8059.39. Because the flaw is exploited through an extension, delivery focuses on the browser environment rather than a network-facing service — the attacker needs the victim to have (or to install) a crafted extension.

2. Triggering the flaw class. The attacker distributes a crafted Chrome extension (via the Chrome Web Store, sideloading, enterprise policy, or social engineering). The extension exercises scroll-related behavior and observes the resulting discrepancy. In CWE-203 terms, the extension measures an observable side effect of the Scroll subsystem whose value depends on a cross-origin target condition the extension is not authorized to read.

3. Payload / execution method. The "payload" here is observational, not code-executing. The crafted extension repeatedly interacts with and measures the observable scroll-related discrepancy to distinguish between cross-origin states, accumulating leaked bits. No memory corruption, ROP chain, or injection primitive is involved.

4. Post-exploitation impact. The attacker converts the observable discrepancy into recovered cross-origin data. Depending on what the scroll subsystem reflects, this can reveal document structure, content characteristics, or state belonging to origins the extension should not be able to access — enabling profiling, deanonymization, or follow-on targeting. There is no privilege escalation or code execution implied by the advisory.

Analysts should treat the exact leakable data set as unconfirmed — the advisory states only "cross-origin data" without specifying which attributes are exposed.

Impact Assessment

• Confidentiality: High (C:H) — the explicit impact is unauthorized access to cross-origin data.
• Integrity: None (I:N) — no modification of data or code is described.
• Availability: None (A:N) — no denial-of-service effect is described.
• Attack Vector: Network (AV:N) — content/extension can be delivered remotely.
• Attack Complexity: Low (AC:L) — given a crafted extension, no special conditions are stated.
• Privileges Required: None (PR:N).
• User Interaction: Required (UI:R) — the victim must run/install the crafted extension.
• Scope: Unchanged (S:U) — impact stays within the browser security context.

Blast radius. Any Chrome user on a version below 155.0.8059.39 who loads a crafted extension is potentially affected. High-value targets include enterprise users running third-party extensions, privacy-sensitive populations exposed to deanonymization, and users who browse authenticated cross-origin applications in the same browser session. The CVSS base score is not provided by the source data (N/A) — the vector above is a class-appropriate assessment and should be treated as derived, not authoritative.

Detection Guidance

Sigma Rule

title: Potential Chrome Extension Abuse for Cross-Origin Data Leak (CVE-2026-106210)
id: 9f2c7a41-6b3e-4d15-9c88-2ad3f0e1b7c4
status: experimental
description: Detects Chrome extension processes exhibiting abnormal scroll-related activity consistent with cross-origin information disclosure via crafted extensions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106210
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\google-chrome'
  selection_meta:
    CommandLine|contains:
      - '--load-extension'
      - '--disable-extensions-except'
  condition: selection_img and selection_meta
  fields:
    - Image
    - CommandLine
    - User
    - ParentImage
falsepositives:
  - Legitimate developer workflows loading unpacked extensions
level: medium
tags:
  - attack.t1185
  - cve.2026.106210

YARA Rule

rule CVE_2026_106210_Chrome_Extension_CrossOrigin_Leak
{
    meta:
        description = "Detects Chrome extension manifests/packages that may be crafted to abuse scroll cross-origin discontinuity (CVE-2026-106210)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106210"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $m1 = "\"manifest_version\"" ascii
        $p1 = "\"permissions\"" ascii
        $p2 = "\"content_scripts\"" ascii
        $s1 = "scroll" ascii nocase
        $s2 = "scrollTo" ascii nocase
        $s3 = "scrollTop" ascii nocase
        $s4 = "scrollHeight" ascii nocase
        $s5 = "scrollIntoView" ascii nocase

    condition:
        $m1 and $p1 and $p2 and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106210 Chrome Extension Cross-Origin Data Leak Attempt"; flow:established,to_server; http.header; content:"User-Agent"; nocase; content:"Chrome/"; nocase; pcre:"/Chrome\/(1[0-4]|15[0-4])\./R"; http.uri; content:"chrome-extension://"; nocase; threshold:type limit, track by_src, count 10, seconds 60; reference:cve,2026-106210; classtype:attempted-recon; sid:2026106210; rev:1;)

Note: extension-origin traffic is local (chrome-extension://), so this network rule targets the associated outbound exfiltration/telemetry pattern rather than the leak surface itself; endpoint telemetry remains the primary detection method.

Elastic Detection

process where host.os.type == "windows" and
  process.name : "chrome.exe" and
  process.args : ("--load-extension*", "--disable-extensions-except*") and
  process.parent.name : ("cmd.exe", "powershell.exe", "explorer.exe")

Splunk SPL Query

index=endpoint sourcetype="WinEventLog:Security" OR sourcetype="Sysmon"
(Image="*\\chrome.exe" OR Image="*\\google-chrome*")
| search CommandLine="*--load-extension*" OR CommandLine="*--disable-extensions-except*"
| eval risk=if(match(CommandLine,"(http|Chrome)"),"high","medium")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmd by host, User
| where count > 0
| sort - first_seen

Wazuh OSSEC Rule

<group name="windows,sysmon,cve_2026_106210,">
  <rule id="106210" level="8">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">chrome\.exe$</field>
    <field name="win.eventdata.commandLine">--load-extension|--disable-extensions-except</field>
    <description>CVE-2026-106210: Chrome launched with unpacked/crafted extension - potential cross-origin data leak</description>
    <mitre>
      <id>T1185</id>
    </mitre>
    <group>cve_2026_106210,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The advisory states that Chrome versions prior to 155.0.8059.39 are affected; this implies a fix at 155.0.8059.39, but no vendor advisory, commit, or changelog entry has been confirmed by any tracked source. Treat as unverified.

1. Immediate mitigations

   • Restrict extension installation: enforce enterprise allowlists for extensions and block sideloading/unpacked extensions via policy.
   • Disable untrusted or unvetted extensions for high-value users; audit currently installed extensions against a known-good inventory.
   • Isolate sensitive cross-origin sessions in separate browser profiles/containers with no third-party extensions.

2. Patch / upgrade steps

   • When a fixed Chrome build at or above 155.0.8059.39 is available and validated, update centrally via enterprise management. Verify the build number against the vendor changelog before deployment, since patch provenance is currently unconfirmed.

3. Long-term hardening

   • Maintain strict extension governance (minimum-necessary permissions, regular review, removal of unused extensions).
   • Enable Chrome's built-in protections (Enhanced Safe Browsing, site isolation where applicable).
   • Monitor Chromium advisories and integrate browser patch SLAs into vulnerability management.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106210
• Google Chrome Releases / Chromium security advisories: https://chromereleases.googleblog.com/
• CWE-203 — Observable Discrepancy: https://cwe.mitre.org/data/definitions/203.html
• MITRE ATT&CK T1185 — Browser Session Hijacking: https://attack.mitre.org/techniques/T1185/
• Chromium extension security model documentation: https://developer.chrome.com/docs/extensions/

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-106210 at this time. The CVE is not listed in CISA KEV, no public PoC exists, and no Nuclei template or exploit code is available.