CVE-2026-102308: Use After Free

Q: What does an attacker need to exploit this issue?

The attacker needs to persuade a user to interact with a crafted HTML page. Exploitation is remote and does not require the attacker to have local access first.

Q: What is the impact if exploitation succeeds?

A successful exploit can allow arbitrary code execution outside the Chrome sandbox. The issue is rated High by Chromium.

Q: Which Chrome versions need to be updated?

Google Chrome versions prior to 154.0.8037.92 are affected. Update Chrome to 154.0.8037.92 or later.

Published Sep 29, 2026

Updated

Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<154.0.8037.92

Event History

Sep 29, 2026

CVE Published

via MITRE·07:45 PM

Data Sourced

via MITRE·07:45 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to persuade a user to interact with a crafted HTML page. Exploitation is remote and does not require the attacker to have local access first.

What is the impact if exploitation succeeds?

A successful exploit can allow arbitrary code execution outside the Chrome sandbox. The issue is rated High by Chromium.

Which Chrome versions need to be updated?