CVE-2026-102327: Incorrect authorization sandbox escape in Chrome on Android · ZeroHour

CVE-2026-102327

mass

Incorrect authorization sandbox escape in Chrome on Android

CVSS 3.1

7.5 high

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome on Android before 154.0.8037.92 has an incorrect-authorization flaw in WebView (CWE-863). A remote attacker who has already compromised the renderer process can use a crafted HTML page to potentially run arbitrary code outside the sandbox. User interaction is required and attack complexity is high; Chromium rated the issue Low even though the published CVSS 3.1 score is 7.5. Anyone still running an affected Chrome-on-Android build is in scope. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Update Google Chrome on Android to version 154.0.8037.92 or later through the Google Play Store, and confirm Android System WebView is current on devices that update it separately. This issue only applies after the renderer process is already compromised and Chromium rated it Low, with no known public exploit, but there is no described workaround other than updating.

Affected

Google Chrome on Android (WebView)

prior to 154.0.8037.92

Estimated exposure

mass≈1 billion or more Chrome-on-Android users on versions before 154.0.8037.92 — Chrome is the default or preinstalled browser on most Android phones and has on the order of a billion or more users worldwide, so installs older than 154.0.8037.92 are a mass population; the share still unpatched after the fix is unknown.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Vendors: google
Products: chrome
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102327

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug