CVE-2026-102315: Sandbox Escape via Uninitialized Memory in Chrome Media on Windows · ZeroHour

CVE-2026-102315

mass

Sandbox Escape via Uninitialized Memory in Chrome Media on Windows

CVSS 3.1

3.4 low

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

CVE-2026-102315 is an uninitialized resource flaw (CWE-908) in the Media component of Google Chrome on Windows, fixed in version 154.0.8037.92. It is not a standalone exploit: the attacker must first have compromised the renderer process (typically via a separate bug), then use a crafted HTML page to trigger the uninitialized-memory read and escape the browser sandbox to read memory outside it. What the attacker gains is an information-disclosure sandbox escape primitive, which is why Chromium rates it High even though the external CVSS score is only 3.4 (low) due to the high attack complexity and prior-compromise prerequisite. All users running Chrome on Windows versions older than 154.0.8037.92 are affected. No public proof of concept exists, the flaw is not on the CISA KEV catalog, and no exploitation has been reported; it was patched as part of the Chrome 154 update that fixed 32 security flaws.

What to do: Update Chrome on Windows to 154.0.8037.92 or later immediately (Help > About Chrome triggers the update) and confirm the version in your environment via enterprise policy or endpoint reporting. Because this bug only yields value to an attacker when chained with a renderer compromise, patching removes the sandbox-escape stage of a full browser exploit chain. IT admins should verify that auto-update is enabled fleet-wide, since unmanaged installations often lag stable-channel releases.

Affected

Google Chrome (Media component, Windows only)

prior to 154.0.8037.92 (fixed in 154.0.8037.92)

Estimated exposure

mass≈1 billion+ users (Chrome on Windows installations worldwide) — Chrome holds roughly two-thirds of global browser market share and runs on well over a billion active Windows devices, so the vulnerable population is plausibly in the hundreds of millions to low billions, clearly an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-908
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102315

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug