CVE-2026-102317: Improper privilege management in Mojo
Chromium CVE-2026-102317: Improper privilege management
Other sources
Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154.0.8037.92 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154.0.4258.53 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 154.0.8037.92 - Upgrade
Upgrade
Microsoft Edge (Chromium-based)to a version that resolves this vulnerability.Patch Chromium CVE-2026-102317
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-102331
- CVE-2026-102312
- CVE-2026-102313
- CVE-2026-102299
- CVE-2026-102306
- CVE-2026-102307
- CVE-2026-102323
- CVE-2026-102303
- CVE-2026-102311
- CVE-2026-102300
- CVE-2026-102326
- CVE-2026-102316
- CVE-2026-102304
- CVE-2026-102328
- CVE-2026-102309
- CVE-2026-102325
- CVE-2026-102308
- CVE-2026-102301
- CVE-2026-102319
- CVE-2026-102324
- CVE-2026-102318
- CVE-2026-102329
- CVE-2026-102315
- CVE-2026-102302
- CVE-2026-102321
- CVE-2026-102320
- CVE-2026-102310
- CVE-2026-102327
- CVE-2026-102330
- CVE-2026-102314
- CVE-2026-102305
Frequently Asked Questions
Which systems are in scope for this issue?
The affected product is Google Chrome on Windows. The issue applies to versions earlier than 154.0.8037.92.
What level of attacker access is required?
The reported attack scenario requires a local attacker and a local program. The potential impact is arbitrary code execution outside Chrome's sandbox.