CVE-2026-102323

A type-confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.92 lets a remote attacker run arbitrary code inside the browser sandbox. It is triggered when a user opens a crafted HTML page; no prior privileges are required, but user interaction is. Impact is high for confidentiality, integrity, and availability within the sandbox, and this issue alone is not described as a sandbox escape. Anyone still running an affected Chrome build is exposed. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later and fully restart the browser so the fix is loaded. Until then, avoid untrusted or unexpected web pages, and in managed environments confirm update policies have actually rolled the fixed build out.