CVE-2026-102328

A type-confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.92 lets a remote attacker run arbitrary code inside the browser sandbox by getting a user to open a crafted HTML page. No privileges are required beyond that user interaction, and the issue is rated high (CVSS 3.1 8.8) with high impact on confidentiality, integrity, and availability within the unchanged sandbox scope. Anyone running an unpatched Chrome build is affected. Chromium rates the bug High severity. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later and fully restart the browser so the fix is applied. Until then, avoid opening untrusted links or HTML pages, because exploitation requires the user to load a crafted page.