CVE-2026-102317: Chrome Windows Mojo flaw allows sandbox escape · ZeroHour

CVE-2026-102317

mass

Chrome Windows Mojo flaw allows sandbox escape

CVSS 3.1

8.6 high

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome on Windows before 154.0.8037.92 has an improper privilege management flaw (CWE-269) in Mojo, the browser's inter-process communication layer. A local attacker can use a local program, with user interaction, to potentially execute arbitrary code outside the Chrome sandbox. Impact is high for confidentiality, integrity, and availability beyond the sandbox (CVSS 3.1 base score 8.6; Chromium severity High). Users of unpatched Google Chrome on Windows are affected. The issue is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Update Google Chrome on Windows to version 154.0.8037.92 or later and confirm the version at chrome://settings/help (automatic updates should apply this if enabled). Until then, avoid running untrusted local programs that interact with Chrome, because the issue is a local sandbox escape that needs a local program and user interaction.

Affected

Google Chrome

Windows versions prior to 154.0.8037.92

Estimated exposure

masshundreds of millions of Windows Chrome installations — Google Chrome has on the order of two billion users and Windows is the dominant desktop OS, so unpatched Windows installs are plausibly in the hundreds of millions; this is an order-of-magnitude estimate, not a measured count of vulnerable…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-269
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102317

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug