CVE-2026-106365

Executive Summary

CVE-2026-106365 is a missing authorization vulnerability (CWE-862) in the Animation component of Google Chrome prior to version 155.0.8059.39. A remote attacker can exploit this flaw by crafting a malicious HTML page that bypasses the web origin policy when a victim visits it, potentially leading to cross-origin data leakage or UI redressing. The vulnerability carries a Chromium security severity rating of Medium; no public proof-of-concept, exploit code, or CISA KEV entry currently exists, and patch confidence is zero due to lack of confirmed vendor patch evidence in tracked sources.

Technical Analysis

The vulnerability resides in Chrome's Animation subsystem. According to the NVD description, the flaw is a missing authorization condition (CWE-862), meaning a security-relevant operation within the Animation feature fails to enforce an authorization check that should restrict access to trusted origins or privileged contexts. The specific attack vector is a crafted HTML page—i.e., the attacker does not need to compromise the browser process directly but instead delivers a web page that triggers the flawed code path.

Because the NVD description is sparse, the exact internal function, interface, or API involved is not disclosed. The vulnerability allows a remote attacker to bypass web origin policy. The web origin policy (Same-Origin Policy) is a foundational browser security boundary that prevents scripts from one origin from reading or modifying resources from another origin. A bypass in the Animation component could plausibly allow a malicious page to interfere with or read data from a different origin—for example, by manipulating animation-triggered state, timing, or cross-origin element interactions.

The Chromium security severity is rated Medium, consistent with a same-origin policy bypass that requires user interaction (victim must visit a crafted page) and results in limited confidentiality/integrity impact rather than remote code execution. No CVSS vector was assigned by NVD, so the vector shown in METADATA is a reasonable analytical estimate for a UI:R, scope-changed origin bypass; it is not an official NVD score. No CVE description details the exact Animation feature (e.g., Web Animations API, CSS animations, compositor animations), so implementers should treat all animation-related rendering surfaces as potentially affected until the upstream fix is analyzed.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification — The attacker identifies a victim running Google Chrome versions earlier than 155.0.8059.39. Because Chrome auto-updates, the attacker targets users with delayed updates, managed enterprise fleets with pinned versions, or embedded Chromium-based browsers that have not yet incorporated the fix.
2. Triggering the Flaw — The attacker hosts or injects a crafted HTML page. When the victim loads this page, the page initiates animation-related operations that reach the vulnerable code path inside Chrome's Animation component. Due to missing authorization, the operation is permitted even though it should be restricted to the page's own origin.
3. Payload / Execution Method — At the vulnerability-class level, the crafted HTML leverages the missing authorization check to bypass the web origin policy. The attacker does not need to deliver a binary payload; the HTML itself, combined with JavaScript that interacts with the animation subsystem, is the exploit vehicle. No specific API endpoints, function names, or parameter names are disclosed in the available intelligence, so the exact JavaScript invocation cannot be described without fabrication.
4. Post-Exploitation Impact — Successful exploitation results in a bypass of the same-origin policy. Depending on what the Animation component can access, this could allow the attacker's page to read or influence content from another origin, potentially leading to cross-site data theft, UI redressing, or session-related abuse. The Medium severity rating and lack of KEV/PoC status suggest that while the bypass is real, its direct impact is bounded and requires user interaction.

Impact Assessment

• Confidentiality: The origin policy bypass may expose cross-origin data to the attacker's page, resulting in limited confidentiality loss.
• Integrity: The attacker may be able to manipulate or inject content across origins, resulting in limited integrity impact.
• Availability: No availability impact is described.
• Scope: Because the flaw bypasses an origin boundary, the impact crosses a security scope (scope change).
• User Interaction: Required—the victim must visit the crafted HTML page.
• Blast radius: All users of Chrome versions below 155.0.8059.39, including enterprise-managed fleets with update delays and Chromium-based derivatives that lag upstream. No server-side component is affected; the impact is client-side per user.
• Business impact: Medium. Not a code-execution flaw, but origin bypasses can undermine trust boundaries for web applications, enable targeted data exfiltration from authenticated sessions, and serve as a component in multi-stage phishing or drive-by campaigns.

Detection Guidance

Sigma Rule

title: Chrome Animation Origin Policy Bypass - Suspicious Child Process or Crash
id: 7f3a9c2e-5b1d-4a8e-9c6f-cve2026106365
status: experimental
description: Detects potential exploitation attempts of CVE-2026-106365 via unusual Chrome renderer behavior or crash artifacts associated with animation origin bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106365
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome:
    Image|endswith:
      - '\chrome.exe'
  selection_flags:
    CommandLine|contains:
      - '--disable-web-security'
      - '--disable-site-isolation-trials'
      - '--disable-features=IsolateOrigins'
  condition: selection_chrome and selection_flags
falsepositives:
  - Legitimate developer testing
level: medium
tags:
  - attack.t1189
  - cve.2026.106365

YARA Rule

rule CVE_2026_106365_Chrome_Animation_Origin_Bypass
{
    meta:
        description = "Detects crafted HTML pages attempting to abuse animation-related origin policy bypass in Chrome < 155.0.8059.39"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106365"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $anim1 = "requestAnimationFrame" ascii wide nocase
        $anim2 = "Animation" ascii wide nocase
        $anim3 = "getAnimations" ascii wide nocase
        $anim4 = "element.animate" ascii wide nocase
        $origin1 = "document.domain" ascii wide nocase
        $origin2 = "postMessage" ascii wide nocase
        $origin3 = "crossOrigin" ascii wide nocase

    condition:
        filesize < 512KB and
        (
            (2 of ($anim*)) and
            (2 of ($origin*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106365 Chrome Animation Origin Policy Bypass Attempt"; flow:established,to_client; content:"text/html"; http.header; content:"Animation"; http.response_body; content:"requestAnimationFrame"; http.response_body; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,2026-106365; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106365; sid:2026106365; rev:1;)

Elastic Detection

process where event.type == "start" and
process.name : "chrome.exe" and
process.args : ("--disable-web-security", "--disable-site-isolation-trials", "--disable-features=IsolateOrigins*")

Splunk SPL Query

index=endpoint OR index=proxy
| search (Image="*\\chrome.exe" AND (CommandLine="*--disable-web-security*" OR CommandLine="*--disable-site-isolation-trials*" OR CommandLine="*--disable-features=IsolateOrigins*"))
    OR (http_user_agent="*Chrome*" AND url="*" AND (response_body="*requestAnimationFrame*" AND response_body="*Animation*"))
| stats count by host, user, url, CommandLine
| where count > 0
| table _time, host, user, url, CommandLine, count

Wazuh OSSEC Rule

<group name="web,chrome,cve-2026-106365,">
  <rule id="202610">
    <decoded_as>json</decoded_as>
    <field name="Image">\.*chrome\.exe$</field>
    <field name="CommandLine">--disable-web-security|--disable-site-isolation-trials|--disable-features=IsolateOrigins</field>
    <description>CVE-2026-106365: Suspicious Chrome launch flags potentially related to origin policy bypass exploitation</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_106365,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented in the provided intelligence; affected version data and OSV package mapping are unavailable.

1. Immediate Mitigations

   • Restrict browsing of untrusted web content in Chrome versions below 155.0.8059.39.
   • Enforce enterprise policies that disable unnecessary animation or experimental web platform features where operationally feasible.
   • Deploy network-level detection (Suricata/Sigma/Elastic rules above) to flag suspicious Chrome launch flags and crafted HTML patterns.
   • Educate users about drive-by compromise via malicious HTML pages (T1189) and enforce safe browsing controls.

2. Patch / Upgrade Steps

   • Upgrade Google Chrome to 155.0.8059.39 or later as soon as it is available through the official update channel.
   • For Chromium-based derivatives, track upstream Chromium releases and apply equivalent fixes once backported.
   • Verify installed version via chrome://version and confirm managed fleet compliance through your endpoint management platform.
   • Because patch confidence is zero, continuously monitor the Chrome release notes for this CVE and re-validate the fix version before closing remediation tickets.

3. Long-Term Hardening

   • Enforce automatic updates for all browsers and maintain an inventory of Chromium-based applications that may lag upstream security fixes.
   • Apply the principle of least privilege to browser processes and enable site isolation and strict origin policies where available.
   • Maintain continuous monitoring for same-origin policy bypass attempts and integrate detection rules into SOC playbooks.
   • Reassess CVSS vector once NVD publishes an official score and adjust risk rankings accordingly.

References

1. NVD — CVE-2026-106365: https://nvd.nist.gov/vuln/detail/CVE-2026-106365
2. Google Chrome Release Notes / Stable Channel Update (consult for version 155.0.8059.39): https://chromereleases.googleblog.com/
3. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
5. CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-106365 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or active threat actor campaign targeting CVE-2026-106365 has been observed in the available intelligence. EPSS has not yet been scored by FIRST.org for this CVE.