CVE-2026-102321

CVE-2026-102321 is a type confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.92. A remote attacker can trigger it by convincing a user to open a crafted HTML page, with no privileges required. Successful exploitation allows arbitrary code execution inside the Chrome sandbox (CVSS 3.1 base score 8.8; user interaction required; scope unchanged, so this is not a sandbox escape). Anyone still running an affected Chrome build is exposed. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later on all desktops and managed devices, and confirm the running version after restart. Until patched, avoid untrusted or unexpected web pages. Enterprises should verify update policies are forcing the fixed build and that older Chrome installs are no longer in use.