CVE-2026-106313

Executive Summary

CVE-2026-106313 is an incorrect authorization (CWE-863) vulnerability in the Browser component of Google Chrome on Android. The flaw permits a local attacker to leverage social engineering against a user and, in combination with a co-installed application on the same device, obtain sensitive information that should have been protected by an authorization boundary. The vulnerability is rated Chromium security severity Medium and carries a CVSS 3.1 base score of 5.1, reflecting a local attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Technical Analysis

The root cause is an authorization defect in Chrome's Browser component on Android, classified as CWE-863 (Incorrect Authorization). Authorization flaws occur when a component fails to correctly verify that a requesting principal — a process, application, or user context — is entitled to access a given resource or perform a given action. Unlike authentication flaws, which concern identity verification, authorization flaws allow an actor who already has some level of local access to cross a boundary they should not be permitted to cross.

The NVD description states three technically significant constraints that define the attack surface:

1. Platform: Android. The issue is specific to Chrome on Android, which means the relevant trust boundaries are the Android application sandbox, the inter-process communication (IPC) surface exposed by Chrome, and the interaction between Chrome and other applications installed on the same device.
2. Attack vector: local. The CVSS vector AV:L confirms the attacker must already have a local presence on the device — this is not a remotely reachable network flaw in Chrome's web-facing rendering surface.
3. Co-installed app condition. The description explicitly requires "a co-installed app," indicating the exploit depends on another Android application residing on the same device. This strongly implies the vulnerability is exercised across an application-to-application boundary, where the Browser component fails to properly authorize access initiated by or relayed through a second local application.

The description further states the attacker leverages social engineering. This indicates the flaw is not a purely silent, no-interaction primitive in practice; the attacker must induce a user to take some action (for example, installing or opening a specific application, or following a crafted flow) before the authorization failure can be abused. Notably, the official CVSS vector lists UI:N (no user interaction) as a scored environmental assumption, while the prose explicitly names social engineering — a discrepancy that should be treated as an indicator that the practical exploitation path is more involved than the numeric vector alone suggests. The context gap should be flagged rather than resolved by assumption.

CVSS AC:H (high attack complexity) is consistent with an exploit that requires a specific, non-trivial set of preconditions: a co-installed application, a crafted local interaction, and social engineering of the victim. PR:N indicates no special privileges are required by the attacker on the device. C:H indicates the confidentiality impact is high — sensitive information is exposed — while I:N and A:N confirm no modification or denial-of-service impact is scored.

Insufficient technical detail is available in the provided data to name specific Chrome IPC interfaces, Android intent actions, permission strings, content provider authorities, or authorization routines involved. No function, class, endpoint, or parameter names are provided in the source description, and none should be assumed. The analysis is therefore constrained to the vulnerability class and the documented attack surface: a local authorization boundary in the Chrome Browser component on Android that is crossed with the assistance of a co-installed application and social engineering.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-106313. The attack chain below is inferred strictly from the vulnerability class (CWE-863) and the constraints stated in the NVD description. No specific implementation details are fabricated.

1) Reconnaissance / target identification. The attacker is assumed to already have a local foothold or a distribution channel for a malicious Android application. The attacker identifies a target device running Google Chrome for Android at a version prior to 155.0.8059.39. Because the flaw requires a co-installed application, reconnaissance focuses on device and application inventory: confirming the Chrome build is in the vulnerable range and establishing a means for a second application to be present on the same device.

2) Triggering the authorization flaw. The attacker leverages social engineering to induce the victim to install, enable, or interact with the co-installed application. Once that second application is present and can interact with the Browser component, the incorrect authorization check in Chrome's Browser component is exercised: a request or interaction that should be denied — or that should only be honored for an appropriately authorized caller — is incorrectly permitted. The essence of CWE-863 is that the boundary check is either missing, performed against the wrong principal, or satisfied by a condition the co-installed app can control.

3) Execution / data access. Because the description does not disclose the specific interface (intent, content provider, IPC channel, or origin) that is mis-authorized, the payload stage is described only at the class level: the co-installed application drives the vulnerable authorization path in coordination with the social-engineering pretext, causing Chrome to release or expose sensitive information to a party that should not have received it.

4) Post-exploitation impact. The exposure is confined to confidentiality (C:H, I:N, A:N). The attacker obtains sensitive information from the Chrome Browser context on the device. There is no scored integrity or availability impact from this CVE. Post-exploitation value depends entirely on what sensitive data the Browser component can be induced to yield in the vulnerable configuration — which the source data does not enumerate.

Given the absence of public exploit artifacts, defenders should treat exploitation as requiring a device-local, multi-component setup and should prioritize detection at the level of suspicious app-to-Chrome interactions rather than signature matches for known malware.

Impact Assessment

The business impact of CVE-2026-106313 is a confidentiality breach on managed Android endpoints running vulnerable Chrome builds. Affected systems are Android devices with Google Chrome below version 155.0.8059.39 — which, given enterprise-scale Android fleet management, may include a broad population of BYOD and corporate-owned handsets before patch rollout completes.

Using the CVSS 3.1 subscores:

• Attack Vector (Local, AV:L): Exploitation requires local presence. This limits blast radius relative to a remotely reachable web flaw and raises the bar for mass exploitation. Mobile devices are, however, inherently "local" endpoints for their users, and a co-installed app provides the local vector.
• Attack Complexity (High, AC:H): Multi-condition exploitation (co-installed app plus social engineering) reduces the likelihood of opportunistic, drive-by attacks and lowers the EPSS expectation. FIRST.org has not yet scored EPSS for this CVE, and no EPSS estimate should be assumed.
• Privileges Required (None, PR:N): The attacker needs no special privilege on the device beyond the ability to place and run the co-installed application.
• User Interaction (None, UI:N in the vector): The vector scores no user interaction, but the description explicitly cites social engineering. Analysts should treat the practical path as involving a user-mediated step and not discount the human element when assessing likelihood.
• Confidentiality (High, C:H): Sensitive information is exposed. The specific data category is not disclosed in the source material.
• Integrity / Availability (None, I:N, A:N): No scored integrity or availability impact.

Blast radius and severity considerations. CVE-2026-106313 is not listed in CISA KEV, no public exploit exists, and no exploit-in-the-wild evidence is provided. The Chromium security severity rating is Medium. The most plausible enterprise exposure is targeted, not opportunistic: an attacker who can get a small malicious or compromised app onto a target handset and pair it with a plausible pretext. This is consistent with targeted mobile intrusion tradecraft rather than commodity malware. For organizations with high-value mobile users (executives, finance, remote staff), a locally exploitable Chrome-on-Android confidentiality flaw is more consequential than its 5.1 base score might imply, because mobile devices often hold unified access to corporate mail, SSO sessions, and chat.

Because the CNA source title is empty and the vendor advisory was not provided, no affected-version matrix beyond the prior to 155.0.8059.39 statement can be confirmed. Affected Versions array in the source data is empty, so no additional version ranges should be inferred.

Detection Guidance

Detection for a locally exploitable, sandbox-boundary authorization flaw is challenging: there is no network payload in the classic sense, so network IDS signatures are low-fidelity. The rules below emphasize application-level and local telemetry — Android app installs, Chrome process interactions, and access anomalies.

Sigma Rule

title: Suspicious Co-Installed App Interacting with Chrome Browser on Android
id: 7f3c9d21-4b5e-4f0a-9c1e-2a6d8e0b5f10
status: experimental
description: Detects local Android application activity consistent with a co-installed app abusing incorrect authorization in Chrome Browser (CVE-2026-106313). Low-fidelity; correlate with app reputation and user reports.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106313
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: android
  service: app_activity
detection:
  selection_browser:
    process_name|contains:
      - 'com.android.chrome'
  selection_suspicious_source:
    actor_package|re:
      - '^(?!com\.android\.chrome|com\.google\.android\.(gms|apps)).+'
  selection_social_pretext:
    activity|contains:
      - 'INSTALL'
      - 'ACTION_VIEW'
      - 'OPEN_LINK'
  condition: selection_browser and selection_suspicious_source and selection_social_pretext
falsepositives:
  - Legitimate applications legitimately opening links in Chrome
  - Browser helper and accessibility applications
level: low
tags:
  - attack.t1204
  - attack.t1657

YARA Rule

rule CVE_2026_106313_Android_CoInstalled_Abuse
{
    meta:
        description = "Heuristic detection of Android app packages exhibiting co-installed-app authorization abuse patterns targeting Chrome (CVE-2026-106313)."
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106313"
        severity = "medium"

    strings:
        $chrome = "com.android.chrome" ascii wide
        $intent = "android.intent.action.VIEW" ascii wide
        $browser_perm = "com.android.browser.permission" ascii wide
        $susp_perm1 = "android.permission.READ_EXTERNAL_STORAGE" ascii wide
        $susp_perm2 = "android.permission.SYSTEM_ALERT_WINDOW" ascii wide

    condition:
        uint32(0) == 0x04034b50 and
        $chrome and
        $intent and
        ($browser_perm or 2 of ($susp_perm*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106313 Possible Android App Distribution Preceding Chrome Local Authz Abuse"; flow:established,to_server; http.method; content:"GET"; http.header; content:"User-Agent"; nocase; http.header; content:"Android"; nocase; http.header; content:"Chrome/1"; nocase; pcre:"/Chrome\/(1[0-4][0-9]|[0-9]{1,2})\./R"; threshold: type limit, track by_src, count 1, seconds 300; classtype:attempted-recon; sid:2026106313; rev:1;)

Elastic Detection

sequence by host.id with maxspan=10m
  [ process where host.os.type == "android" and
      process.name : "com.android.chrome" and
      process.command_line : "*intent*" ]
  [ process where host.os.type == "android" and
      process.parent.name : "com.android.chrome" and
      not process.name : ("com.google.android.gms", "com.android.chrome") ]

Splunk SPL Query

index=android sourcetype=app_activity OR sourcetype=chrome_events
| eval vers=coalesce(chrome_version, app_version)
| where isnull(vers) OR (tonumber(mvindex(split(vers, "."),0)) < 155)
| search (process_name="com.android.chrome" OR actor_package="com.android.chrome")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(actor_package) as source_packages
        values(activity) as activities
        by host, user
| where count > 0 AND mvcount(source_packages) > 0
| eval risk="possible CVE-2026-106313 local authz abuse"
| sort - count

Wazuh OSSEC Rule

<group name="android,chrome,cve_2026_106313">
  <rule id="100313" level="6">
    <decoded_as>json</decoded_as>
    <field name="event_type">app_activity</field>
    <field name="actor_package" negate="yes">com.android.chrome</field>
    <field name="browser_target" type="pcre2">com\.android\.chrome</field>
    <description>CVE-2026-106313: Non-Chrome app interacting with Chrome Browser - possible local authorization abuse</description>
    <mitre>
      <id>T1204</id>
      <id>T1657</id>
    </mitre>
  </rule>

  <rule id="100314" level="9">
    <if_sid>100313</if_sid>
    <field name="actor_reputation">unknown</field>
    <description>CVE-2026-106313: Unknown co-installed app performing Chrome Browser interaction - investigate device</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was provided from any tracked source. No vendor fix reference, workaround, or patch artifact is available in the source data. The NVD description references Chrome on Android "prior to 155.0.8059.39," which defines the affected range, but no vendor advisory URL or commit was included. Treat this CVE as unpatched in the authoritative source data until a Google Chrome for Android Stable release advisory is confirmed.

1) Immediate mitigations

• Inventory Android devices running Google Chrome and identify those below version 155.0.8059.39.
• Restrict application installation from unknown sources via Android Enterprise / MDM policy, and enforce Google Play Protect verification. Because the flaw requires a co-installed app, reducing the ability of untrusted apps to reside on managed devices lowers exploitability.
• Apply application allow-listing on high-value managed devices where feasible, so that an unknown second app cannot be present to exercise the authorization boundary.
• Train users against social-engineering pretexts that encourage installing side-loaded or third-party apps on devices that also carry corporate Chrome profiles.
• Where a managed device is suspected of compromise, isolate it from corporate resources and preserve forensic state before wiping.

2) Patch / upgrade steps

• Monitor the Google Chrome for Android Stable release channel for the fixed build and update devices to Chrome for Android 155.0.8059.39 or later as soon as it is published.
• Because no patch artifact is confirmed in the source data, do not assume availability based on the version string alone; verify against Google's official Chrome release notes and the Chromium security severity advisory once it is published.
• Push the update via MDM in managed fleets, and enforce minimum-version policy on managed Chrome deployments.

3) Long-term hardening

• Enforce automatic Chrome updates on all managed Android devices to reduce the window of exposure for future authorization flaws.
• Maintain continuous mobile vulnerability inventory (OS build, Chrome version, installed packages) so exposure windows can be measured precisely during future vulnerabilities.
• Prioritize defense against social engineering through recurring user awareness training tailored to mobile app-installation pretexts.
• Review Android Enterprise configurations periodically, ensuring that install permissions and inter-application capabilities are minimized for non-required apps.

References

• NVD — CVE-2026-106313: https://nvd.nist.gov/vuln/detail/CVE-2026-106313
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK — T1657 Financial Theft / T1204 User Execution: https://attack.mitre.org/techniques/T1657/ and https://attack.mitre.org/techniques/T1204/
• Google Chrome Releases (Stable channel advisories): https://chromereleases.googleblog.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106313 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are associated with CVE-2026-106313 in the available data. EPSS has not been scored by FIRST.org.