CVE-2026-102310: Missing Authorization in Google Chrome Payments Component Prior to 154.0.8037.92 · ZeroHour

CVE-2026-102310

mass

Missing Authorization in Google Chrome Payments Component Prior to 154.0.8037.92

CVSS 3.1

6.5 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

CVE-2026-102310 is a missing authorization flaw (CWE-862) in the Payments (Web Payments) component of Google Chrome in versions prior to 154.0.8037.92. A remote attacker who has already compromised the renderer process can trigger the bug via a crafted HTML page to bypass web origin policy, gaining a primitive to break Chrome's origin isolation. Because exploitation presupposes prior renderer compromise (typically via a separate renderer memory-safety bug), this is a secondary weakening of the sandbox rather than an initial-entry vulnerability, and Google rated it Low severity. All users running unpatched Chrome are affected, and Chromium-based derivatives that ship this component generally inherit the issue until they pull the fix. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported; it was fixed in Chrome 154.0.8037.92 as part of an update addressing 32 security flaws.

What to do: Update Chrome to 154.0.8037.92 or later (verify at chrome://settings/help, since auto-update may lag or be disabled on managed fleets). IT administrators should confirm managed browsers are on the current stable channel and that update policies are not pinning old versions. Because exploitation requires the attacker to first compromise the renderer process, keep Site Isolation enabled and prioritize rapid patching of higher-severity renderer bugs that could serve as the entry point; no emergency action beyond normal patch cadence is warranted for this Low-severity issue.

Affected

Google Chrome

prior to 154.0.8037.92

Estimated exposure

mass≈2–3 billion Chrome users potentially exposed before patching — Chrome holds roughly two-thirds of the global browser market across an internet population of about 5 billion users, so essentially all Chrome installations older than 154.0.8037.92 were exposed until auto-update applied the fix.

Description

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Vendors: google
Products: chrome
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102310

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug