CVE-2026-106324

Executive Summary

CVE-2026-106324 is an incorrect authorization vulnerability (CWE-863) in the WebAppInstalls component of Google Chrome on Android prior to version 155.0.8059.39. A remote attacker can exploit this flaw to bypass system access restrictions by convincing a user to open a crafted HTML page. Because the vulnerability resides in the WebAppInstalls subsystem — which normally mediates Progressive Web App (PWA) installation and the permissions associated with installed web applications — a successful bypass could allow a web page to perform privileged actions that should otherwise require explicit user or system authorization.

Technical Analysis

The vulnerability is classified under CWE-863 (Incorrect Authorization), meaning that an authorization check in the WebAppInstalls subsystem does not correctly enforce the intended access control policy. In the Chromium/Chrome architecture, WebAppInstalls is the component responsible for handling the installation lifecycle of web applications (PWAs), including the validation of installation requests, the assignment of app-related permissions, and interaction with Android platform services.

The NVD description states that the flaw is an "incorrect authorization" issue that "allowed a remote attacker to bypass system access restrictions via a crafted HTML page." The key technical facts derivable from this disclosure are:

1. Attack vector is remote and network-based — the attacker delivers content through a web page, requiring no local access to the device.
2. User interaction is required — the phrase "via a crafted HTML page" indicates the victim must navigate to, or be lured into loading, attacker-controlled HTML. This typically maps to CVSS UI:R (User Interaction: Required).
3. The weakness is authorization-related, not memory-corruption — CWE-863 indicates a logic/access-control defect rather than an out-of-bounds or use-after-free bug. The consequence is a bypass of "system access restrictions," i.e., an authorization boundary enforced by Chrome/Android on behalf of installed web apps.
4. Platform specificity: Android only — the flaw is scoped to Chrome on Android, indicating the defective authorization logic likely involves the interface between the Chromium WebAppInstalls implementation and Android platform-level permissions or intents.

The Chromium security severity is rated Medium, consistent with an access-control bypass that requires user interaction and does not directly yield memory corruption or full code execution within the browser sandbox by itself. The specific authorization check, the exact HTML feature that triggers it, and the resulting privileged action are not detailed in the available NVD description; therefore, no specific function names, API parameters, or file paths can be asserted. The vulnerability should be understood at the class level: a web-triggerable web app installation flow where the authorization decision governing a restricted operation is made incorrectly, allowing a page to exceed the privileges it should have been granted.

Exploitation Scenarios

No public proof-of-concept or exploit code is available (POC_STATUS: None). The attack chain below is inferred strictly from the vulnerability class (CWE-863, incorrect authorization) and the NVD description; no specific implementation details are invented.

1. Reconnaissance / target identification. The attacker identifies Android users running Chrome versions prior to 155.0.8059.39. Because the flaw is triggered through a crafted HTML page, targeting is passive: any user who visits a malicious or compromised page with a vulnerable browser becomes a candidate. No special network position is required — only that the victim loads attacker-controlled HTML.

2. Triggering the flaw class. The attacker hosts or injects a crafted HTML page that exercises the web app installation flow. Because the authorization check in WebAppInstalls is incorrect, the page is able to complete an installation-related action — or to obtain privileges associated with an installed web app — without the authorization that the intended policy would require. The precise HTML construct that reaches the faulty authorization decision is not described in the source data.

3. Execution / bypass method. At the vulnerability-class level, the crafted page causes the authorization routine to return an allow decision where it should have denied or required additional consent. This constitutes the "bypass of system access restrictions" described by NVD. The attacker does not need to deliver a binary payload; the crafted HTML itself is the attack vehicle.

4. Post-exploitation impact. Successful exploitation results in a bypass of authorization boundaries governing web app installation privileges. The practical impact is bounded by what the mis-authorized web app action can reach: an attacker gains capabilities that the platform intended to reserve for properly authorized web apps. Given the Medium severity rating and the user-interaction requirement, the impact is not an unconditional device takeover but rather an escalation of web app privileges beyond the intended authorization policy.

Impact Assessment

Affected systems. Google Chrome on Android at versions prior to 155.0.8059.39. Desktop Chrome, ChromeOS, and other Chromium-based browsers are not indicated by the NVD description.

Blast radius. Any Android user with a vulnerable Chrome build who visits a crafted HTML page is potentially exposed. Because no exploit code is public and no in-the-wild exploitation evidence is reported, the immediate operational risk is currently assessed as low-to-moderate, but the exposure base — consumer and enterprise-managed Android devices running Chrome — is very large.

CVSS context. No CVSS vector or score is published for this CVE (CVSS Score: N/A). Based on the described characteristics, an inferred vector consistent with the disclosure is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (network vector, user interaction required, scope unchanged, partial confidentiality and integrity impact, no availability impact). This inference reflects the remote, user-interaction-dependent authorization bypass class and should be treated as provisional until an authoritative score is assigned.

Business impact. For enterprises, the primary concern is an authorization bypass on managed Android endpoints: a compromised web page could achieve a web app privilege that violates the intended access policy. No CISA KEV listing is present, and EPSS has not yet scored this CVE, so no evidence of active exploitation exists in the provided data.

Detection Guidance

Sigma Rule

title: Chrome Android WebAppInstalls Authorization Bypass Attempt (CVE-2026-106324)
id: 6f2c1a94-3b7e-4d21-9c88-0a1f5e2d7b64
status: experimental
description: Detects web app installation activity in Chrome on Android that may
  correspond to a crafted HTML page attempting to bypass authorization checks in
  the WebAppInstalls component.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106324
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1204.001
logsource:
  category: web
  product: android
detection:
  selection_useragent:
    cs-user-agent|contains:
      - 'Chrome/'
      - 'Android'
  selection_install_activity:
    cs-uri-query|contains:
      - 'install'
      - 'webapp'
  condition: selection_useragent and selection_install_activity
falsepositives:
  - Legitimate PWA installation flows triggered by users
level: medium

YARA Rule

rule CVE_2026_106324_Chrome_Android_WebAppInstall_Bypass
{
    meta:
        description = "Detects HTML pages attempting to abuse the Chrome Android WebAppInstalls authorization bypass (CVE-2026-106324)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106324"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "WebAppInstalls" nocase
        $b = "beforeinstallprompt" nocase
        $c = "getInstalledRelatedApps" nocase
        $d = "start_url" nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x6874
        and filesize < 512KB
        and 2 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106324 Chrome Android WebAppInstalls Authorization Bypass Attempt"; flow:established,to_server; http.user_agent; content:"Android"; nocase; http.user_agent; content:"Chrome/"; nocase; http.uri; content:"install"; nocase; http.header; content:"Referer"; nocase; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106324; sid:2026106324; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [ network where network.protocol == "http" and
      user_agent.original : "*(Linux; Android*" and
      user_agent.original : "*Chrome/*" and
      url.path : "*install*" ]
  [ network where network.protocol == "http" and
      user_agent.original : "*(Linux; Android*" and
      url.query : "*webapp*" ]

Splunk SPL Query

index=proxy OR index=web
| eval ua=coalesce(user_agent, http_user_agent, cs_user_agent)
| where match(ua, "(?i)Android") AND match(ua, "(?i)Chrome/")
| search uri="*install*" OR uri_query="*webapp*" OR referer="*webappinstall*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, ua
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,chrome,cve-2026-106324,">
  <rule id="106324" level="10">
    <decoded_as>json</decoded_as>
    <field name="user_agent">\.?Android</field>
    <field name="user_agent">Chrome/</field>
    <field name="url">install</field>
    <description>CVE-2026-106324: Possible Chrome Android WebAppInstalls authorization bypass attempt via crafted page</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Confirm whether Android devices in the fleet run Chrome versions below 155.0.8059.39; prioritize managed/mobile workforce devices.
• Enforce mobile device management (MDM) policies that restrict Chrome's web app installation capabilities where feasible, and tighten browsing controls (web filtering, Safe Browsing enforcement).
• Treat this as a browser-hygiene issue: restrict user navigation to untrusted HTML pages through corporate proxy/DNS filtering, and harden Android app permission policies via MDM.
• Because exploitation requires user interaction with a crafted HTML page, user awareness and phishing-resistant browsing guidance provide partial compensating control.

2) Patch/upgrade steps.

• No vendor patch reference is available from tracked sources for this CVE. Monitor the Google Chrome release channels and the Chromium security releases page for the fix associated with version 155.0.8059.39 (and any Android-specific build variant).
• Once a fixed build is published, upgrade Chrome on Android to version 155.0.8059.39 or later via Google Play or enterprise app distribution.
• Verify version compliance programmatically across managed devices and re-scan after rollout.

3) Long-term hardening.

• Maintain an automated inventory of browser versions across Android endpoints and alert on known-vulnerable versions.
• Adopt a rapid mobile browser update cadence, since Chrome on Android is a fast-moving, high-exposure attack surface.
• Enforce least-privilege Android app permissions and limit web app installation rights through MDM configuration profiles.
• Subscribe to Chromium security advisories and NVD updates for this CVE to act immediately when the patch reference becomes available, and reassess patch confidence when new data arrives.

References

• NVD — CVE-2026-106324: https://nvd.nist.gov/vuln/detail/CVE-2026-106324
• Google Chrome Releases (Stable channel updates for Android): https://chromereleases.googleblog.com/
• Chromium Security — report and fix tracking: https://www.chromium.org/Home/chromium-security/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no KEV entry for this CVE as of the data provided)

No threat actor campaigns or exploit-in-the-wild evidence are reported in the available data for CVE-2026-106324.