Description
Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: UI Spoofing via Web Authentication
Action: Apply Patch
AI Analysis

Impact

A missing authorization check in Chrome’s Web Authentication system allows a remote attacker to deliver a specially crafted HTML page that causes the browser to display substituted UI elements. The flaw enables attackers to fake prompts or dialogs during Web Authentication processes. The vulnerability is classified as an authorization weakness (CWE‑862).

Affected Systems

Google Chrome users running any desktop stable channel version earlier than 155.0.8059.39 are affected. No other vendors or products are listed as impacted.

Risk and Exploitability

The attack vector is remote: an adversary can embed malicious content in a web page that the victim visits while using Chrome. The CVSS score is 5.4, indicating a medium risk level. The issue does not provide a path to code execution or privilege escalation; the primary risk is misleading users via spoofed authentication prompts. No EPSS score is currently available, and the vulnerability is not in the CISA KEV catalog, so exact exploitation probability is unknown. Despite the low Chromium severity rating, users should patch promptly to eliminate this UI spoof risk.

Generated by OpenCVE AI on October 7, 2026 at 12:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome version 155.0.8059.39 or newer from the official stable channel update.
  • Restart the browser to ensure all processes use the patched code.
  • Regularly check the vendor’s website or update channel for newer releases that include additional security fixes.

Generated by OpenCVE AI on October 7, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Missing authorization in Web Authentication (Passkeys & Security Keys)
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Web Authentication Missing Authorization Enables UI Spoofing in Chrome

Wed, 07 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Web Authentication Missing Authorization Enables UI Spoofing in Chrome

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T10:30:14.418Z

Reserved: 2026-10-06T16:33:51.409Z

Link: CVE-2026-106264

cve-icon Vulnrichment

Updated: 2026-10-07T10:22:04.769Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:53.880

Modified: 2026-10-07T13:53:36.140

Link: CVE-2026-106264

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:37Z

Links: CVE-2026-106264 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T13:00:06Z

Weaknesses