Google Chrome CVE-2026-102322

Exploitation requires the victim to use a Chrome build prior to 155.0.8059.39 and to visit attacker-controlled or compromised web content containing a crafted HTML page that triggers the SiteIsolation incorrect-authorization condition (CWE-863). No authentication or prior privileges are needed (PR:N), but the required user interaction (UI:R) - navigating to the malicious page - is the primary limiting factor and is why SSVC rates the flaw non-automatable. There is no indication of a non-default configuration dependency; standard Chrome with SiteIsolation enabled (the default) is the target. Realistic risk is bounded by the need for social-engineering/drive-by delivery rather than unattended remote compromise.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score of 9.6 is driven by network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and a changed scope (S:C) with total CIA impact - consistent with a SiteIsolation authorization bypass that breaks Chrome's cross-origin security boundary and yields arbitrary code execution. However, the attack requires user interaction (UI:R): a victim must visit a crafted HTML page, which meaningfully lowers the practical severity versus a zero-click flaw. The SSVC framework tempers the picture further: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (user interaction prevents mass/wormable automation), while Technical Impact is 'total' - so the capability ceiling is high but the likelihood of broad exploitation is currently low. There is no KEV listing and no POC reported in the provided data, so this is not confirmed active exploitation. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: this is a genuinely high-impact browser flaw in a ubiquitous product and warrants prompt patching, but the current real-world risk is 'patch promptly' rather than 'emergency/exploited-in-wild,' given required user interaction, non-automatable exploitation, and no evidence of active abuse.

A remote attacker hosts or compromises a web page containing crafted HTML that abuses the SiteIsolation incorrect-authorization flaw; when a victim using a vulnerable Chrome build (prior to 155.0.8059.39) visits the page, the attacker bypasses cross-site process isolation and executes arbitrary code in the victim's browser context. No authentication is required (PR:N) but the victim must be lured into visiting the page (UI:R). No public exploit code was identified in the provided data at time of analysis.