CVE-2026-102316: Use-After-Free in Google Chrome Views Enables Sandbox-Escaping Code Execution · ZeroHour

CVE-2026-102316

mass

Use-After-Free in Google Chrome Views Enables Sandbox-Escaping Code Execution

CVSS 3.1

9.6 critical

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

A use-after-free vulnerability exists in the Views component of Google Chrome in versions prior to 154.0.8037.92. A remote attacker can trigger the flaw by convincing a victim to visit a crafted HTML page, typically via social engineering such as a malicious link in email or chat. Successful exploitation allows the attacker to execute arbitrary code outside the browser's sandbox, which is significant because sandbox escape defeats Chrome's core defense-in-depth layer and exposes the host system directly. All users running Chrome versions older than 154.0.8037.92 on any platform are affected. Google rates the severity High and the CVSS 3.1 score is 9.6 (critical); however, there is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.

What to do: Update Chrome to version 154.0.8037.92 or later immediately (Chrome's auto-update normally handles this; verify via Help > About Google Chrome or check chrome://settings/help). Enterprise administrators should confirm fleet-wide patch rollout and check update policies in Google Workspace / browser management consoles. Also verify that Chromium-based browsers in the environment (e.g., Edge, Brave, Opera) have pulled the corresponding upstream fix, since they inherit Chromium flaws until they ship their own update.

Affected

Google Chrome

All versions prior to 154.0.8037.92

Estimated exposure

mass≈3 billion+ users (all unpatched Chrome installations; Chrome holds roughly two-thirds of global browser market share) — Chrome is the dominant browser worldwide with an estimated 3+ billion active users, so essentially every installation not yet updated past 154.0.8037.92 is a potential target.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102316

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug