CVE-2026-102309: Use After Free

Q: What does an attacker need to exploit this vulnerability?

The attacker needs to induce a user to load a crafted HTML page. The issue is remotely exploitable and can result in arbitrary code execution outside Chrome's sandbox.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 154.0.8037.92 are affected. Update Chrome to 154.0.8037.92 or a later version.

Published Sep 29, 2026

Updated

Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<154.0.8037.92

Event History

Sep 29, 2026

CVE Published

via MITRE·07:45 PM

Data Sourced

via MITRE·07:45 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this vulnerability?

The attacker needs to induce a user to load a crafted HTML page. The issue is remotely exploitable and can result in arbitrary code execution outside Chrome's sandbox.

Which Chrome versions should be remediated?