CVE-2026-102329

This is a high-severity cross-site scripting flaw in Google Chrome's WebUI, the browser's set of privileged internal pages (such as chrome:// settings pages). If a user visits an attacker-crafted HTML page, the flaw lets the attacker's script bypass web origin policy and execute in the context of a privileged page, where it could read sensitive browser data or manipulate browser settings and state. All Chrome versions before 154.0.8037.92 are affected, and the flaw was fixed in the Chrome 154 stable-channel update that resolved 32 security issues. No public proof-of-concept exists, the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been reported, though details are typically limited while users update.

What to do: Update Chrome to version 154.0.8037.92 or later immediately via Chrome menu > Help > About Google Chrome (or chrome://settings/help), which triggers the update and relaunch. Enterprise admins should confirm auto-update policies are working across managed fleets and verify the Stable channel build. Users of other Chromium-based browsers should apply their vendor's update once it incorporates the fix.