CVE-2026-102324: Use-after-free sandbox escape in Chrome Picture-in-Picture · ZeroHour

CVE-2026-102324

mass

Use-after-free sandbox escape in Chrome Picture-in-Picture

CVSS 3.1

8.3 high

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome versions before 154.0.8037.92 contain a use-after-free (CWE-416) in the Picture-in-Picture feature. A remote attacker who has already compromised the renderer process can trigger it with a crafted HTML page and potentially execute arbitrary code outside the sandbox. Impact is high for confidentiality, integrity, and availability with changed scope, but exploitation needs user interaction and a prior renderer compromise, which is why attack complexity is rated high (CVSS 3.1 base score 8.3). Anyone still running an unpatched Google Chrome release before 154.0.8037.92 is affected. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is none known.

What to do: Update Google Chrome to version 154.0.8037.92 or later and confirm automatic updates are enabled so the fix is applied promptly. This bug is a sandbox escape that requires a prior renderer compromise, so staying current on Chrome releases also reduces the chance of a chainable renderer flaw. No public exploit is known, but unpatched browsers should still be treated as high priority given the High Chromium severity and CVSS 8.3 score.

Affected

Google Chrome

prior to 154.0.8037.92

Estimated exposure

masson the order of 1–3 billion Chrome installations until updated — Google Chrome is the dominant browser, with a multi-billion-user installed base and roughly 60% or more of global browser usage, so releases before 154.0.8037.92 plausibly cover on the order of billions of installations until auto-update…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102324

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug