CVE-2026-102326

CVE-2026-102326 is a type-confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.92. A remote attacker can trigger it by convincing a user to open a crafted HTML page; no privileges are required, but user interaction is required. Successful exploitation allows arbitrary code execution inside Chrome’s sandbox (Chromium severity High; CVSS 3.1 base score 8.8), which can expose data and actions available to the renderer process but does not by itself escape the sandbox. Everyone running an affected Chrome build is in scope until they update. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later on every device (chrome://settings/help, or your managed browser update channel) and restart the browser so the fix is loaded. Until then, avoid untrusted or unexpected web pages, because the bug is triggered by crafted HTML and needs a user to open it. Treat this as sandboxed renderer code execution, not a confirmed full-system compromise; no public exploit or CISA KEV listing is known.