CVE-2026-102304: Use-after-free in Chrome Passwords allows sandbox escape · ZeroHour

CVE-2026-102304

mass

Use-after-free in Chrome Passwords allows sandbox escape

CVSS 3.1

9.6 critical

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome versions before 154.0.8037.92 contain a use-after-free flaw (CWE-416) in the Passwords component. A remote attacker can trigger it by getting a user to open a crafted HTML page, then execute arbitrary code outside the browser sandbox. The issue needs no prior privileges and is rated High by Chromium, with a CVSS 3.1 base score of 9.6 (network, low complexity, user interaction required, changed scope, high confidentiality, integrity, and availability impact). Anyone still running an unpatched Chrome build older than 154.0.8037.92 is affected. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later on all user and managed endpoints, and confirm the running build via chrome://settings/help. Prioritize machines that browse untrusted web content. No workaround is described in the advisory, so treat any earlier build as exposed to remote code execution if a user opens a malicious page.

Affected

Google Chrome

prior to 154.0.8037.92

Estimated exposure

masson the order of 1–3 billion Chrome users until updated past 154.0.8037.92 — Google Chrome is the dominant desktop browser, with a majority of global browser market share and on the order of billions of active users; every install older than the fixed build is in scope until updated.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102304

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug