CVE-2026-102322: Incorrect authorization RCE in Google Chrome Site Isolation · ZeroHour

CVE-2026-102322

mass

Incorrect authorization RCE in Google Chrome Site Isolation

CVSS 3.1

9.6 critical

EPSS

—

Published

Oct 6, 2026 (2d ago)

Modified

Oct 8, 2026

AI analysis

Google Chrome versions prior to 155.0.8059.39 contain an incorrect-authorization flaw (CWE-863) in the Site Isolation component. A remote attacker can trigger it by convincing a user to open a crafted HTML page; no prior privileges are required beyond that interaction. Successful exploitation can result in arbitrary code execution, with high impact on confidentiality, integrity, and availability and a changed scope in the CVSS 3.1 score of 9.6 (vendor severity: High). Anyone still running an unpatched Chrome build is affected. There is no known public proof of concept, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Update Google Chrome to version 155.0.8059.39 or later (chrome://settings/help, or your enterprise update channel) and confirm the running version after restart. Until that build is installed, avoid opening untrusted or unexpected web pages and links. Administrators should prioritize rollout and verify that builds older than 155.0.8059.39 are no longer in use.

Affected

Google Chrome

prior to 155.0.8059.39

Estimated exposure

mass≈2–3 billion Chrome installations (global user base; all builds before 155.0.8059.39) — Google Chrome has on the order of three billion users worldwide; every installation that has not yet received 155.0.8059.39 is in scope, so exposure is mass until auto-update completes.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102322

In the news1 stories

Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws