Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin… (CVE-2026-106322)

CVE-2026-106322 describes an open redirect vulnerability in the AppManifest feature of Google Chrome before version 155.0.8059.39. An attacker can exploit this by crafting a malicious HTML page that causes the browser to redirect in a way that bypasses the web origin policy, potentially misleading users or enabling further attacks that rely on origin trust assumptions. The vulnerability is classified under CWE-601 (Open Redirect).

Successful exploitation could allow attackers to bypass the web origin policy, which may lead to limited confidentiality and integrity impacts by tricking users into interacting with malicious content appearing to originate from trusted sources. The CVSS score of 6.1 reflects a medium severity with low complexity and no privileges required, but user interaction is necessary.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update affected Chrome installations to this version or newer to remediate the vulnerability. No additional mitigations are indicated by the vendor advisory.