Google Chrome: Incorrect authorization in SiteIsolation
Summary
Google Chrome versions before 155.0.8059.39 contain an incorrect authorization flaw in SiteIsolation, Chrome's per-site process isolation feature. A remote attacker can use a crafted HTML page to execute arbitrary code in the browser. The CVSS vector requires user interaction, such as the user visiting the page. Chromium rates the issue High, and the CNA CVSS score is 9.6 (Critical).
Affected
- Google Chrome prior to 155.0.8059.39 (desktop, Windows, macOS and Linux)
- Chromium-based browsers (for example Microsoft Edge, Brave) that have not yet integrated the fix: Unknown.
Fixed in
- Google Chrome 155.0.8059.39 or later (Stable channel update of 6 October 2026). Chrome Releases lists 155.0.8059.39/.40 for Windows and macOS and 155.0.8059.39 for Linux. Malwarebytes reports different build numbers; verify on the Chrome Releases post.
- Debian bookworm: 155.0.8059.39-1~deb12u1
Workaround
Unknown. No vendor-documented workaround is known. Updating the browser is the required fix.
Exploitation
- No evidence of active exploitation known at the time of writing. CISA ADP does not mark the CVE as known exploited; the CISA KEV catalogue was not checked directly.
- No public proof of concept found. Public bug details may be restricted until most users have updated.
Our recommendation
- Update all Chrome installations to 155.0.8059.39 or later, or a newer Stable build, and verify the version on every managed endpoint.
- Enforce browser updates centrally, for example with Chrome Enterprise policies.
- Check Chromium-based browsers such as Edge and Brave for their own fix dates.
- Re-check the CISA KEV catalogue and the Chromium bug tracker for changes in exploitation status.
- Priority: high for SMEs, because the flaw is remotely exploitable and any browsing staff member is exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OSV: DEBIAN-CVE-2026-102322 osv.dev
- CISA ADP VulnRichment record (HOL Guard) hol.org
- Vulmon vulnerability details vulmon.com
- Malwarebytes: update Chrome to fix critical security issues www.malwarebytes.com
- BleepingComputer: Google releases Chrome 155 with 247 security fixes www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:22.
Original description (NVD)
Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.