CVE-2026-102302

Google Chrome versions before 154.0.8037.92 contain a stack-based buffer overflow (CWE-121) in the V8 JavaScript engine. A remote attacker can trigger it by getting a user to open a crafted HTML page; no prior privileges are required, but user interaction is. Successful exploitation allows arbitrary code execution inside the Chrome sandbox, with high impact on confidentiality, integrity, and availability within that sandbox (CVSS 3.1 8.8); the unchanged scope means this issue alone does not escape the sandbox. Anyone still running Google Chrome older than 154.0.8037.92 is affected. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later and fully restart the browser so the fix is loaded. Keep automatic updates enabled and confirm the running version is at or above 154.0.8037.92. Until updated, avoid opening untrusted or unexpected web pages, because the flaw is triggered by a crafted HTML page.