CVE-2026-106372

Executive Summary

CVE-2026-106372 is an incorrect authorization vulnerability in the user interface (UI) layer of Google Chrome versions prior to 155.0.8059.39, classified under CWE-863. A remote attacker can exploit this by convincing a victim to open a crafted HTML page, which may result in arbitrary code execution outside the browser sandbox. The CVSS v3.1 base score is 9.6 (Critical), reflecting a network-reachable, low-complexity attack requiring user interaction but with scope change and high confidentiality, integrity, and availability impact.

Technical Analysis

The vulnerability is categorized as CWE-863 (Incorrect Authorization), meaning that an authorization check within a UI component either fails to execute, executes against the wrong principal, or can be bypassed entirely. In the context of Google Chrome, the UI layer spans browser-process components that render and manage user-facing surfaces and, critically, that broker privilege-separated interactions between renderer processes and the browser process.

The Chromium security architecture relies on a multi-process model in which untrusted web content is rendered in a sandboxed renderer process, while privileged operations are performed by the browser process. A UI-layer authorization flaw is significant because UI code frequently sits on the trusted side of that boundary: dialogs, permission prompts, origin indicators, and similar surfaces act as the arbiters of what the user has authorized the browser to do. If an attacker-supplied HTML page can cause UI code to mis-evaluate an authorization state, the resulting consistency gap can be used to bypass an intended trust boundary.

The NVD description states that exploitation requires a "crafted HTML page," placing the initial injection point in ordinary web content — the lowest-privilege attack surface in the browser. The outcome, however, is stated as "potentially execute arbitrary code outside the sandbox." The sandbox is the browser's principal containment mechanism; code execution "outside the sandbox" implies escape from renderer confinement into a higher-privilege context. The described mechanism is that the incorrect authorization decision opens the path to that escape, though the NVD text does not specify which UI component, permission check, or inter-process interface is involved.

Independent technical details are not available. The NVD description does not name specific functions, classes, endpoints, IPC messages, or affected files, and no CNA title was supplied. Chromium's own security severity rating for this issue is Medium, notably lower than the 9.6 CVSS v3.1 base score assigned in the NVD record — a common divergence for sandbox-escape-class bugs whose high vector scores reflect worst-case scope change rather than demonstrated exploitability.

The following are known with confidence: the vulnerability class is an authorization logic error (CWE-863); the attack vector is network-delivered web content (AV:N); no privileges or credentials are required (PR:N); exploitation requires the victim to interact with the crafted page (UI:R); and the impact, if exploited, is scope-changing with high CIA impact (S:C/C:H/I:H/A:H).

The following are not known and should not be assumed: the specific UI surface affected, the exact authorization check that is incorrect, whether a full sandbox escape is reliably achievable or merely "potential" as worded in the NVD text, and whether exploitation requires additional chained vulnerabilities.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-106372 at the time of writing. The attack chain below is described strictly at the vulnerability-class level and is inferred from the NVD description; no implementation-specific details are fabricated.

1. Reconnaissance and target identification. The attacker identifies victims running a Chrome build earlier than 155.0.8059.39. Because the flaw is reached through web content rather than a network service, identification is typically passive: the attacker controls or compromises a web page (or injects content into one) that the target is expected to visit. No scanning of victim infrastructure is required, which removes the usual reconnaissance signature of exploitation campaigns.

2. Triggering the flaw class. The attacker hosts or injects crafted HTML. When the victim loads that page in a vulnerable Chrome build, the browser's UI layer makes an incorrect authorization decision — an authorization check that should restrict or gate privileged browser behavior instead permits it. Per CWE-863, this is a logic defect in the authorization decision itself, not a memory-safety issue: the attacker does not need to corrupt memory to reach the defect, only to drive the UI into the state the incorrect check mis-evaluates. The crafted page is the delivery vector; the trigger occurs inside the browser as the page is rendered and processed.

3. Payload and execution method. The NVD description states the outcome as arbitrary code execution outside the sandbox. At the vulnerability-class level, the attacker's page is the carrier for whatever content is required to exercise the flawed authorization path; once the incorrect authorization permits the privileged operation, the intended confinement guarantees no longer apply. The NVD text does not describe the payload format, the privileged operation involved, or the mechanism by which code escapes the sandbox, and none should be assumed.

4. Post-exploitation impact. Code executing outside the sandbox runs with the privileges of the browser process rather than those of the sandboxed renderer. On a typical endpoint, that means access to user data, browser profile contents, and the ability to interact with the operating system within the limits of the browser process's token. Impact is rated high across confidentiality, integrity, and availability, with a scope change indicating the vulnerable UI component's failure affects resources beyond its own security authority.

Because no exploit code or PoC is available, organizations should treat this as a credible-but-unproven exploitation path and prioritize patching on the basis of the severity score and the sandbox-escape impact class rather than on observed activity.

Impact Assessment

The CVSS v3.1 base score is 9.6 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Subscore interpretation:

• Attack Vector (Network): the flaw is reachable over the network via HTTP/HTTPS-delivered content; no local or adjacent access is required.
• Attack Complexity (Low): no specialized conditions or race conditions are described as prerequisites; a crafted page is sufficient.
• Privileges Required (None): the attacker needs no account or credential on the target.
• User Interaction (Required): the victim must open the crafted HTML page, which realistically means clicking a link, loading a malicious advertisement, or visiting a compromised site. This is the primary practical constraint on mass exploitation.
• Scope (Changed): successful exploitation affects components beyond the vulnerable UI component's security authority — consistent with sandbox escape.
• Confidentiality / Integrity / Availability (High/High/High): worst-case impact includes full compromise of data, code, and availability within the browser process's reach.

Business impact: affected systems are any endpoint running Google Chrome earlier than 155.0.8059.39. Because Chrome is a ubiquitous enterprise browser, the blast radius is broad, but exploitation is not self-propagating and requires victim interaction. The realistic threat profile is targeted or watering-hole delivery against high-value users rather than indiscriminate mass compromise. Endpoints that process sensitive data, hold authenticated sessions to corporate SaaS and internal applications, or are operated by executives, administrators, and developers represent the highest-value targets. The EPSS score has not yet been published by FIRST.org; no prediction of exploitation likelihood should be inferred.

Detection Guidance

Sigma Rule

title: Suspicious Chrome Process Spawning Non-Browser Child Processes
id: 9f2c1a44-7b3e-4d61-9a02-cve2026106372
status: experimental
description: Detects Chrome spawning unexpected child processes or writing executable content, consistent with post-sandbox-escape code execution (CVE-2026-106372).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106372
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_legit:
    CommandLine|contains:
      - '--type='
  condition: selection_parent and selection_suspicious_child and not filter_legit
falsepositives:
  - Legitimate browser extensions or enterprise tooling invoking external processes
level: high
tags:
  - attack.t1190
  - attack.t1204.002
  - cve.2026.106372

YARA Rule

rule EXPL_CVE_2026_106372_Chrome_UI_Authz_Bypass
{
    meta:
        description = "Detects HTML content attempting to trigger Chrome UI authorization bypass (CVE-2026-106372)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106372"
        severity = "critical"

    strings:
        $html1 = "<html" nocase
        $js1 = "chrome://" nocase
        $js2 = "window.open" nocase
        $js3 = "iframe" nocase
        $js4 = "postMessage" nocase
        $js5 = "javascript:" nocase
        $obf1 = "eval(" nocase
        $obf2 = "atob(" nocase
        $obf3 = "unescape(" nocase

    condition:
        $html1 and 2 of ($js*) and 1 of ($obf*)
}

Note: this rule targets generic HTML/JavaScript indicators associated with browser-exploitation delivery pages. It does not encode any vulnerability-specific byte pattern, because no such pattern is public for CVE-2026-106372.

Suricata IDS Rule

alert http any any -> any any (msg:"EXPLOIT Possible Google Chrome UI Authorization Bypass Attempt (CVE-2026-106372)"; flow:established,to_client; content:"Content-Type|3a 20|text/html"; http_header; content:"<script"; http_client_body; pcre:"/(chrome\x3a\x2f\x2f|postMessage|window\.open)/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; sid:9006372; rev:1; reference:cve,2026-106372; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106372;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ process where process.parent.name == "chrome.exe" and process.name : "chrome.exe" ]
  [ process where event.action == "start" and process.parent.name == "chrome.exe" and
      process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe", "rundll32.exe") ]

Splunk SPL Query

index=endpoint (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="win:process")
EventCode=1 ParentImage="*\\chrome.exe"
| where match(lower(Image), "(cmd\\.exe|powershell\\.exe|wscript\\.exe|mshta\\.exe|rundll32\\.exe|regsvr32\\.exe)$")
| where NOT match(CommandLine, "--type=")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdline by Computer, User, ParentImage, Image
| where count > 0
| eval severity="high", cve="CVE-2026-106372"
| sort - last_seen

Wazuh OSSEC Rule

<group name="windows,sysmon,exploit,">
  <rule id="1006372" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">chrome\.exe$</field>
    <field name="win.eventdata.image">(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</field>
    <description>CVE-2026-106372: Suspicious child process spawned by Chrome - possible post-sandbox-escape execution</description>
    <mitre>
      <id>T1190</id>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_106372,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available from tracked sources beyond the "prior to 155.0.8059.39" boundary stated in the NVD description.

1. Immediate mitigations

• Update Google Chrome to version 155.0.8059.39 or later if a build at or above that version is available in the vendor channel; the NVD description identifies that version as the remediation boundary.
• Alternatively, switch affected users to a browser build that includes the fix, or apply an enterprise browser management policy to force update checks.
• Where immediate upgrade is not possible, reduce exposure: restrict browsing of untrusted sites, enforce network-level URL filtering, and enable Chrome's site isolation and enhanced safe browsing. Note that these are compensating controls, not fixes, and do not remediate the authorization defect.
• Treat unsolicited links, advertisements, and documents that open in Chrome as elevated risk until the fleet is updated.

2. Patch and upgrade steps

• Confirm the installed version via chrome://version and inventory endpoints against 155.0.8059.39.
• Push the update through Chrome's enterprise update mechanisms or the organization's software deployment tooling.
• Restart the browser to apply the update; verify post-restart version.
• Re-scan after deployment to confirm fleet compliance and identify persistently outdated hosts (notably unmanaged BYOD devices and non-domain endpoints).

3. Long-term hardening

• Maintain a defined maximum patch latency for internet-facing browsers and track browser versions as a first-class asset attribute.
• Enforce enterprise browser policies that prevent disabling automatic updates.
• Apply least privilege to browser process tokens on managed endpoints to limit the reach of any post-sandbox-escape execution.
• Monitor for child processes spawned by chrome.exe as a standing detection (see Detection Guidance), independent of this CVE.
• Because the vendor self-rates this issue Medium while CVSS scores it 9.6, base prioritization on both the vendor rating and observed exploitation rather than score alone; revisit the rating if exploit activity emerges.

References

• NVD — CVE-2026-106372: https://nvd.nist.gov/vuln/detail/CVE-2026-106372
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Google Chrome Releases (check for the 155.0.8059.39 stable channel entry): https://chromereleases.googleblog.com/
• FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss/

No CISA Known Exploited Vulnerabilities entry exists for CVE-2026-106372. No public proof-of-concept, exploit code, or Nuclei template is available. No threat actor campaign or exploit-in-the-wild evidence has been reported in the provided data.