Google Chrome CVE-2026-106322

Exploitation requires the attacker to host a crafted HTML page that abuses Chrome's AppManifest handling AND to socially engineer the victim into visiting and interacting with that page (UI:R in the CVSS vector). It affects default Chrome installations prior to 155.0.8059.39 with no special browser configuration needed, but the mandatory user interaction and reliance on social engineering are the primary limiting factors - the attacker cannot trigger the redirect without a lured, interacting victim. Impact is limited to an origin-policy bypass / redirect (low confidentiality and integrity, no availability impact), not code execution.

This is a medium-severity open redirect (CWE-601) in Chrome's AppManifest handling, and the signals are internally consistent and point to a genuinely low-priority issue rather than a hidden high-risk one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes network-reachable, unauthenticated, low-complexity exploitation that nonetheless requires user interaction (UI:R) and yields only low confidentiality/integrity impact with a scope change - exactly what an origin-policy-bypassing redirect looks like. EPSS is low (0.20%, 9th percentile), the vulnerability is NOT in CISA KEV, no public POC is referenced, and CISA SSVC scores it Exploitation:none / Automatable:no / Technical Impact:partial. All sources agree: no active exploitation, no automation, partial impact. There is no conflict between signals here - the moderate 6.1 score, low EPSS, absent KEV, and SSVC 'none' all reinforce that this is a defense-in-depth fix, not an urgent threat. The only material caveat is that exploitation depends on successful social engineering (the description explicitly cites a crafted HTML page plus a lured user), which further limits real-world leverage. Patch promptly through normal Chrome update cadence, but this does not warrant emergency response.

An attacker crafts a malicious HTML page abusing the AppManifest open redirect and lures a Chrome user (via phishing link or malicious ad) to visit it. When the user interacts with the page, the redirect bypasses web origin policy to send them to an attacker-controlled destination that can impersonate a trusted site for credential theft or further payload delivery. No public exploit code is referenced, and successful exploitation hinges on the victim both visiting the page and interacting with it.