CVE-2026-102299

A type confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.92 allows a remote attacker to execute arbitrary code inside the browser sandbox. It is triggered when a user opens a crafted HTML page; no privileges are required beyond that interaction. Successful exploitation can compromise confidentiality, integrity, and availability of data available to the sandboxed renderer, but the reported impact stays inside the sandbox rather than granting full control of the host by itself. Anyone still running an unpatched Google Chrome build older than 154.0.8037.92 is affected. There is no known public proof of concept, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Update Google Chrome to version 154.0.8037.92 or later on every device and confirm automatic updates are enabled. Until that build is installed, avoid opening untrusted or unexpected web pages in Chrome. Code execution is limited to the sandbox, so also keep the operating system and the rest of the browser patched.