CVE-2026-106410: Missing authorization in Google Chrome

This vulnerability in Google Chrome's Permissions system allows an attacker with control over the renderer process to spoof user interface elements by crafting malicious HTML content. The flaw is due to missing authorization checks, enabling UI spoofing attacks. The issue affects Chrome versions before 155.0.8059.39 and was assigned a medium severity by the Chromium security team. The vendor has released an update to address this issue.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof UI elements, potentially misleading users and causing them to perform unintended actions. The impact is limited to UI spoofing and does not directly imply code execution or data theft. The severity is rated medium by the vendor.

Users should update Google Chrome to version 155.0.8059.39 or later, where this vulnerability has been fixed. The vendor advisory confirms that a stable channel update addresses this issue. No additional mitigation steps are required beyond applying the official update.