CVE-2026-106368

Executive Summary

CVE-2026-106368 is a user interface (UI) misrepresentation vulnerability in Google Chrome on Android affecting versions prior to 155.0.8059.39. A remote attacker can spoof UI elements through a crafted HTML page, requiring user interaction to trigger. With a CVSS score of 5.4 (Medium), the impact is limited to low confidentiality and low availability effects, but the spoofing nature of the flaw poses a credible phishing and social-engineering risk to enterprise mobile fleets.

Technical Analysis

The vulnerability is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. This weakness class describes scenarios where a software interface presents misleading or falsified information to the user, causing them to misinterpret critical security-relevant state. In the context of a web browser, UI misrepresentation typically involves the browser rendering attacker-controlled content in a manner that impersonates trusted browser chrome (e.g., address bar, permission prompts, security indicators, or full-screen overlays).

Per the NVD description, the flaw is specific to Google Chrome running on the Android platform. A remote attacker can deliver a crafted HTML page that causes the browser to misrepresent UI elements. The phrase "spoof UI elements" indicates the attacker can manipulate the visual presentation so that a user believes they are interacting with legitimate browser or site UI when they are actually interacting with attacker-supplied content. The CVSS vector—AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:R (user interaction required), S:U (scope unchanged), C:L (low confidentiality), I:N (no integrity), A:L (low availability)—confirms that exploitation is remote and unaunthenticated but demands that a victim visit the malicious page or interact with it.

The underlying mechanism is not further detailed in the available intelligence. Chromium security severity is rated Low, suggesting that the root cause is likely a specific rendering or permission-prompt handling defect rather than a memory-safety issue. Because no patch evidence is available from tracked sources and no PoC, exploit code, or Nuclei template is publicly associated, the exact code-level trigger (e.g., a particular DOM API, CSS construct, or intent handling path) cannot be established from the provided data. What is known is that the attack vector is a crafted HTML page rendered in Chrome on Android, and the outcome is UI spoofing—a class of issue commonly leveraged for credential phishing, consent manipulation, or tricking users into granting permissions or downloading files.

The Chromium project routinely addresses UI spoofing issues in its release cycle. The fact that the affected version boundary is given as "prior to 155.0.8059.39" indicates that a fix landed in that build, even though no patch reference is curated in the provided intelligence feed. Analysts should treat the version threshold as the authoritative fixed boundary and verify against Google's official Chrome release notes for Android.

Exploitation Scenarios

1. Reconnaissance/target identification. The attacker identifies a target population of Android users running Google Chrome versions earlier than 155.0.8059.39. Because the attack is delivered over the web, no scanning of specific hosts is required; the attacker only needs victims to load a page. Mass phishing campaigns, malicious ads (malvertising), or compromised legitimate sites can serve as delivery vehicles. Reconnaissance is therefore minimal and opportunistic rather than host-specific.

2. Triggering the flaw class. The attacker crafts an HTML page designed to cause Chrome on Android to misrepresent UI elements. The vulnerability class—UI misrepresentation—is triggered when the browser renders attacker-controlled markup in a way that visually impersonates trusted interface components. At the vulnerability-class level, the crafted page exploits a rendering or prompt-handling logic defect so that the displayed UI no longer faithfully represents the underlying browser or site state. The precise DOM, CSS, or JavaScript construct that induces the misrepresentation is not disclosed in the available intelligence, and no public PoC exists; the attack chain beyond this point is inferred from the vulnerability class.

3. Payload/execution method. Delivery is a crafted HTML page hosted on an attacker-controlled or compromised domain. The victim must navigate to the page (UI:R). Once rendered, the spoofed UI misleads the user—for example, presenting a false security indicator, a fake permission dialog, or a disguised prompt—so the user believes they are interacting with legitimate browser functionality. No code execution beyond the browser's web content sandbox is implied by the CVSS vector; there is no scope change (S:U) and no integrity impact (I:N).

4. Post-exploitation impact. The measurable impact is low confidentiality and low availability loss (C:L/A:L). Realistically, the primary consequence is user deception: a victim could be induced to disclose limited information, accept a misleading state, or experience degraded interaction with the browser. Because integrity impact is rated None and no privilege escalation is indicated, the flaw is best characterized as a social-engineering enabler rather than a system-compromise vector. No public PoC is available; the described chain is inferred from the vulnerability class and NVD description.

Impact Assessment

The CVSS 3.1 base score is 5.4 (Medium), derived from AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. The network attack vector and low complexity mean exploitation is technically easy to attempt at scale, but the required user interaction (UI:R) and unchanged scope (S:U) constrain the ceiling. Confidentiality impact is Low—some information may be exposed to or elicited by the spoofed UI—and availability impact is Low, suggesting possible disruption of normal browser interaction. Integrity impact is None, meaning the attacker cannot directly modify data through this flaw per the assigned vector.

Affected systems are Android devices running Google Chrome versions below 155.0.8059.39. Given Chrome's dominant mobile market share, the blast radius in an enterprise context includes BYOD and managed Android fleets, mobile web users accessing corporate SaaS, and any workforce relying on Chrome for Android for authentication workflows. Because the flaw enables UI spoofing, the most plausible business impact is increased susceptibility to phishing and consent-manipulation attacks, which can lead to credential theft or unauthorized data disclosure downstream—even though the CVE itself does not grant code execution. CISA KEV status is NO, and no exploit-in-the-wild or threat-actor campaign is associated in the provided data. EPSS is not yet scored by FIRST.org, so predictive exploitation likelihood cannot be quantified at this time. The practical risk is elevated for organizations with high mobile exposure and weak phishing-resistant authentication, where a convincing spoofed UI can bypass user vigilance.

Detection Guidance

Sigma Rule

title: Potential Chrome on Android UI Spoofing Attempt (CVE-2026-106368)
id: 7c9a1f2e-4b3d-4e6a-9c1f-106368chrome
status: experimental
description: Detects indicators of UI misrepresentation / spoofing delivered via crafted HTML pages to Chrome on Android prior to 155.0.8059.39.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106368
author: valtersit.com
date: 2026-01-01
logsource:
  category: web
  product: proxy
detection:
  selection_ua:
    cs-user-agent|contains:
      - 'Chrome/'
      - 'Android'
  selection_path:
    cs-uri|contains:
      - '.html'
      - '.htm'
  selection_keywords:
    cs-uri-query|contains:
      - 'overlay'
      - 'spoof'
      - 'prompt'
      - 'login'
      - 'verify'
  condition: selection_ua and selection_path and selection_keywords
falsepositives:
  - Legitimate login and verification pages served to Chrome on Android
level: low
tags:
  - attack.t1190
  - cve.2026-106368

YARA Rule

rule CVE_2026_106368_Chrome_Android_UI_Spoof
{
    meta:
        description = "Detects crafted HTML content attempting UI misrepresentation in Chrome on Android (CVE-2026-106368)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106368"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $html1 = "<html" ascii nocase
        $chrome = "chrome" ascii nocase
        $ua_android = "Android" ascii nocase
        $ui_spoof1 = "position:fixed" ascii nocase
        $ui_spoof2 = "z-index" ascii nocase
        $ui_spoof3 = "overlay" ascii nocase
        $ui_spoof4 = "spoof" ascii nocase
        $prompt = "permission" ascii nocase

    condition:
        $html1 and $chrome and $ua_android and 2 of ($ui_spoof*) and $prompt
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106368 Possible Chrome Android UI Spoofing Crafted HTML"; flow:established,to_client; http.user_agent; content:"Chrome/"; http.user_agent; content:"Android"; http.header; content:"Content-Type"; content:"text/html"; http.uri; content:"html"; pcre:"/(overlay|spoof|permission|prompt|verify)/Ui"; classtype:attempted-user; sid:1063680; rev:1; reference:cve,2026-106368; metadata:affected_product Chrome_Android;)

Elastic Detection

sequence by host.name
  [ network where network.protocol == "http"
      and http.request.headers contains "Android"
      and http.request.headers contains "Chrome/"
      and http.response.headers.content_type contains "text/html" ]
  [ network where network.protocol == "http"
      and url.query contains ("overlay" or "spoof" or "prompt" or "verify" or "permission") ]

Splunk SPL Query

index=proxy OR index=web
| where match(useragent, "(?i)Android") AND match(useragent, "(?i)Chrome/")
| where match(uri, "(?i)\.html?") OR match(content_type, "(?i)text/html")
| where match(uri, "(?i)(overlay|spoof|prompt|verify|permission|login)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest, uri, useragent
| where count > 5
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,chrome,cve-2026-106368,">
  <rule id="106368" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <field name="user_agent">Android</field>
    <field name="user_agent">Chrome/</field>
    <field name="url">\.html?</field>
    <description>CVE-2026-106368: Possible Chrome on Android UI spoofing crafted HTML page requested</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106368,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Treat the fixed version boundary (155.0.8059.39) as the only reliable reference. Because the flaw allows UI spoofing requiring user interaction, reinforce phishing-resistant authentication (FIDO2/passkeys) so that spoofed UI cannot translate into credential compromise. Apply mobile threat defense or DNS/web filtering to block known phishing and malvertising domains. Enforce awareness training focused on mobile browser prompt spoofing, and disable or restrict unnecessary browser permission prompts via managed configurations where feasible. Restrict installation of unknown APKs and keep Google Play Protect enabled.

2. Patch/upgrade steps. Update Google Chrome on Android to version 155.0.8059.39 or later. In managed environments, push the update through Google Play managed configurations or EMM/MDM policies, and verify version compliance across the fleet. Track Google's official Chrome for Android release notes for the security fix corresponding to CVE-2026-106368 once published. Organizations using Chrome on non-Android platforms are not indicated as affected by this specific CVE.

3. Long-term hardening. Maintain rapid browser patch cadence for mobile endpoints; require automatic updates where policy permits; monitor browser version drift with continuous compliance scanning. Adopt a defense-in-depth approach to UI-redress and spoofing threats, including anti-clickjacking and overlay protections, and monitor for unusual full-screen or overlay patterns at the web gateway. Because CWE-451 issues recur across browser releases, integrate UI-spoofing indicators into SOC detection engineering and periodic phishing simulations targeting mobile users.

References

• NVD — CVE-2026-106368: https://nvd.nist.gov/vuln/detail/CVE-2026-106368
• Google Chrome Releases (Chrome for Android security updates): https://chromereleases.googleblog.com/
• Chromium Security Severity Guidelines: https://www.chromium.org/developers/severity-guidelines/
• CWE-451 — User Interface (UI) Misrepresentation of Critical Information: https://cwe.mitre.org/data/definitions/451.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106368 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, public proof-of-concept, or exploit-in-the-wild activity are associated with CVE-2026-106368 in the provided intelligence data.