CVE-2026-106280

Executive Summary

CVE-2026-106280 is an incorrect authorization vulnerability (CWE-863) in the PermissionElement component of Google Chrome versions prior to 155.0.8059.39. A remote attacker can potentially bypass web origin policy by luring a victim to a crafted HTML page, weakening the same-origin trust boundary that governs browser permission handling. The vulnerability is rated Medium severity by Chromium security, is not listed in CISA KEV, and no public proof-of-concept or exploit code is currently tracked.

Technical Analysis

The vulnerability resides in Chrome's PermissionElement, a user-agent-controlled interface element used to surface and manage browser permission prompts (for example, geolocation, notifications, camera, or microphone requests) directly within page content. NVD classifies the weakness as CWE-863: Incorrect Authorization, with the explicit impact that a remote attacker may "potentially bypass web origin policy via a crafted HTML page."

In practical terms, an improper-authorization defect in a permission-surfacing component means the browser's enforcement of which origin is entitled to request, display, or act on a permission decision can be subverted. Origin policy is the foundational browser security boundary: it determines that scripts and resources from attacker.example cannot read, manipulate, or act upon state belonging to victim.example. When a permission-related element performs authorization checks incorrectly, the element may render, reflect state, or pass a permission decision in a context that crosses that boundary.

Two aspects of the description are notable for defenders:

1. Attack vector is a crafted HTML page. Exploitation does not require authentication, local access, or a malicious extension. The attacker delivers markup, and the victim's browser does the rest. This is the classic drive-by model (ATT&CK T1189): a watering hole, a malicious ad, a phishing link, or a compromised site hosting injected markup.
2. The defect is authorization, not memory safety. CWE-863 describes logic that reaches a decision point but validates the wrong subject, principal, or context. There is no implication of memory corruption, use-after-free, or remote code execution in the provided data. The expected impact is a policy/trust-boundary bypass rather than arbitrary code execution on the host.

Chrome's multi-process architecture is relevant context. The PermissionElement is part of the browser's permission UI and its associated renderer-side representation. Authorization logic for whether a given document may embed, display, and interact with such an element must be enforced on the browser side of the process boundary; if enforcement is delegated to or trusted from the renderer, a compromised or malicious renderer can assert state it should not hold. The NVD description does not disclose which specific check is flawed, so the precise code path cannot be stated with confidence.

The Chromium security severity is "Medium," which in Chromium's own taxonomy corresponds to a meaningful but constrained security bug — typically one requiring user interaction, with limited confidentiality or integrity impact and no reliable code execution. This aligns with the origin-policy-bypass framing: undesirable cross-origin behavior, but not a sandbox escape.

Because the NVD description, CNA title, and associated data provide no function-level detail, no specific class names, method names, DOM APIs, or internal code paths beyond PermissionElement itself should be assumed. Any claim about the precise conditional that is mis-evaluated would be speculation.

Exploitation Scenarios

The following chain is derived strictly from the vulnerability class (CWE-863, incorrect authorization) and the described vector (crafted HTML page causing origin policy bypass). No public exploit exists, so this is an inferred attack chain, not a validated one.

1. Reconnaissance / target identification. The attacker does not need to fingerprint a specific host; the target is the browser, not a server. Any user running Chrome below 155.0.8059.39 is a candidate. The attacker identifies delivery surfaces where arbitrary HTML reaches victims: compromised websites, ad networks, user-generated content platforms, or phishing pages. Because exploitation requires user interaction (a page load), the attacker focuses on traffic volume and plausible legitimacy rather than targeting a specific organization.

2. Triggering the flaw class. The attacker authors a crafted HTML page that embeds or manipulates a PermissionElement in a manner the browser is supposed to reject. The incorrect authorization check means the browser fails to correctly verify the origin context — for example, whether the embedding origin is entitled to present or act on that permission surface. Because the description is explicit that origin policy is what gets bypassed, the crafted page's goal is to cause a permission-related interaction to occur under a context the same-origin policy should have prevented. No specific DOM method, attribute, or event name can be asserted here; only that the trigger is crafted markup interacting with PermissionElement.

3. Execution / payload method (class level). There is no code-injection payload in the memory-corruption sense. The "payload" is the HTML document itself plus any script the attacker controls, which attempts to leverage the mis-authorized permission element to reach across an origin boundary. The attacker's script acts only within the privileges the broken check wrongly grants it.

4. Post-exploitation impact. Successful exploitation yields an origin policy bypass — the attacker's content can potentially obtain or influence permission state that should belong to, or be gated by, another origin. Depending on which permission is affected, downstream consequences could include misleading the user into granting a permission in the wrong context, or reading/altering permission-related state cross-origin. The NVD description does not specify which permissions are reachable, so the concrete blast radius per-permission cannot be enumerated from available data. There is no evidence in the provided data of sandbox escape, code execution, or persistence.

Defenders should treat this as a client-side, user-interaction-dependent browser logic flaw. Exploitation in the wild has not been reported, and no threat actor campaign is associated with this CVE in the provided data.

Impact Assessment

• Confidentiality: Low — a permission/origin-policy bypass may expose limited cross-origin permission state depending on which permission surface is affected. NVD provides no CVSS vector, so this assessment is qualitative and derived from the CWE and Chromium severity rating only.
• Integrity: Low — the attacker may influence or spoof permission-related decisions that should be origin-bound.
• Availability: None implied by the description.
• Scope: The flaw is in the client browser, not a server. Blast radius is the population of affected Chrome installations, but per-incident impact is confined to a single browsing session's origin/permission boundary.
• Exploitability context: Requires user interaction (page load), no authentication, remote delivery. Chromium rates the issue Medium, consistent with constrained impact and the absence of code execution.
• Business impact: For enterprises, the primary risk is weakened browser trust guarantees for users who browse untrusted web content — the default state for most knowledge workers. This is not a server-compromise-class issue and does not warrant emergency incident response, but it does belong in a browser patch-tracking and rapid-update program.
• Blast radius qualifier: Absent per-permission detail, the precise set of affected permissions and the maximum achievable cross-origin effect cannot be determined from the provided data.

Detection Guidance

Because the trigger is standard HTML rendering inside Chrome, network-layer detection is inherently low-fidelity. The rules below target the vulnerability class and the Chrome version condition rather than a specific, known exploit signature.

Sigma Rule

title: Chrome PermissionElement Origin Policy Bypass - Vulnerable Version Asset
id: 8f3c1a2e-4b7d-4e21-9c6a-0d5e2f7b91aa
status: experimental
description: Detects Google Chrome versions below 155.0.8059.39 (CVE-2026-106280) via file version metadata on endpoints, indicating exposure to the PermissionElement incorrect authorization flaw.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106280
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\chrome.exe'
  selection_ver:
    - CommandLine|contains: 'Google Chrome'
  condition: selection_proc and selection_ver
fields:
  - Image
  - CommandLine
  - User
level: informational
falsepositives:
  - Legitimate Chrome launches unrelated to exploitation
  - Detection requires external version enrichment; Sigma alone cannot read PE file version strings reliably

YARA Rule

rule CVE_2026_106280_PermissionElement_OriginBypass_HTML
{
    meta:
        description = "Heuristic detection of HTML pages attempting to interact with the Chrome PermissionElement in an origin-bypass context (CVE-2026-106280). Low-fidelity heuristic."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106280"
        severity = "medium"

    strings:
        $pe1 = "PermissionElement" ascii wide nocase
        $pe2 = "<permission" ascii nocase
        $js1 = "permission" ascii nocase
        $js2 = "requestPermission" ascii nocase
        $js3 = "origin" ascii nocase

    condition:
        filesize < 512KB and
        (uint16(0) == 0x3C21 or uint16(0) == 0x6D3C) and
        $pe1 and
        (2 of ($js*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106280 Potential Chrome PermissionElement Origin Policy Bypass - PermissionElement in HTTP Response"; flow:established,to_client; http.response_body; content:"PermissionElement"; nocase; content:"permission"; nocase; distance:0; within:512; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,2026-106280; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106280; sid:2026106280; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence low;)

Elastic Detection

process where process.name == "chrome.exe" and
  process.command_line like~ "*chrome*" and
  not process.parent.name in ("explorer.exe", "chrome.exe", "services.exe")

Note: This is a placeholder baseline for anomalous Chrome launch context on Windows. Elastic EQL operates on endpoint telemetry; because CVE-2026-106280 is a client-side renderer flaw with no host-level artifact described in the source data, EQL cannot reliably detect the vulnerability itself. Enrichment against Chrome build version is required to identify exposure.

Splunk SPL Query

index=proxy OR index=web
| eval body=lower(coalesce(http_response_body, response_body, ""))
| where like(body, "%permissionelement%") AND like(body, "%permission%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Detects HTTP responses delivered to clients containing PermissionElement references combined with permission-related keywords — a weak heuristic for crafted pages attempting the bypass.

Wazuh OSSEC Rule

<group name="web,cve_2026_106280,">
  <rule id="106280" level="6">
    <decoded_as>json</decoded_as>
    <field name="http.response.body">\.?(?i)PermissionElement</field>
    <description>CVE-2026-106280: Potential Chrome PermissionElement origin policy bypass content observed in HTTP response</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_106280,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Treat Chrome below 155.0.8059.39 as exposed. Because the described fix target is that build, prioritize getting managed endpoints onto 155.0.8059.39 or later via the standard Chrome update channel, and verify version compliance through your software inventory rather than assuming auto-update succeeded.
   • Where a rapid fleet upgrade is not immediately possible, constrain exposure: restrict browsing of untrusted content through policy, and consider enterprise URL filtering to reduce drive-by delivery surfaces (ad networks, low-reputation hosts).
   • Manage site permission defaults via enterprise policy to reduce the value of permission-surface abuse (for example, default-deny for notifications, camera, and microphone on non-allowlisted origins), which limits the practical payoff of an origin-policy bypass.
   • Monitor for suspicious cross-origin permission prompts reported by users; this is a user-visible class of anomaly.

2. Patch / upgrade steps

   • Deploy Chrome 155.0.8059.39 or later. Confirm the build number on updated hosts, as the NVD data specifies a fixed version but provides no vendor advisory, changelog, or CVE-page cross-reference in the supplied materials.
   • Re-verify any third-party Chromium-based browsers against their upstream adoption of the corresponding Chromium fix; they do not necessarily track Chrome version numbering.

3. Long-term hardening

   • Maintain an automated browser version-compliance check with alerting on outdated builds, treating the browser as a tier-1 externally exposed attack surface.
   • Enforce site-permission default policies and review allowlists quarterly.
   • Keep endpoint detection focused on post-exploitation behavior rather than attempting to signature a logic flaw that produces no distinct host artifact.
   • Track Chrome stable release channels and CVE feeds so that Medium-severity browser authorization flaws are patched on a predictable cadence rather than reactively.

References

• NVD — CVE-2026-106280: https://nvd.nist.gov/vuln/detail/CVE-2026-106280
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• Google Chrome Release Notes / Stable Channel Updates: https://chromereleases.googleblog.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106280 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or threat actor campaign is associated with CVE-2026-106280 in the provided data. Exploitation in the wild has not been reported, and the vulnerability is not present in CISA KEV.