CVE-2026-106416: Code injection in Google Chrome

CVE-2026-106416 describes a code injection vulnerability in Google Chrome extensions before version 155.0.8059.39. An attacker can exploit this by crafting a malicious Chrome extension that spoofs UI elements, potentially misleading users. The vulnerability relies on social engineering to be effective. Google has published a stable channel update to fix this issue.

The vulnerability allows remote attackers to inject code into Chrome extensions, enabling UI spoofing. This could deceive users into interacting with malicious interface elements, potentially leading to further compromise or unauthorized actions. However, exploitation requires social engineering, and no known exploits are reported in the wild.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.