CVE-2026-102327: Incorrect authorization in WebView
Chromium CVE-2026-102327: Incorrect authorization in WebView
Other sources
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154.0.8037.92 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155.0.4283.48 - Upgrade
Upgrade
Google Chrome for Androidto a version that resolves this vulnerability.Fixed in 154.0.8037.92
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-102331
- CVE-2026-102317
- CVE-2026-102312
- CVE-2026-102313
- CVE-2026-102299
- CVE-2026-102306
- CVE-2026-102307
- CVE-2026-102323
- CVE-2026-102303
- CVE-2026-102311
- CVE-2026-102300
- CVE-2026-102326
- CVE-2026-102316
- CVE-2026-102304
- CVE-2026-102328
- CVE-2026-102309
- CVE-2026-102325
- CVE-2026-102308
- CVE-2026-102301
- CVE-2026-102319
- CVE-2026-102324
- CVE-2026-102318
- CVE-2026-102329
- CVE-2026-102315
- CVE-2026-102302
- CVE-2026-102321
- CVE-2026-102320
- CVE-2026-102310
- CVE-2026-102330
- CVE-2026-102314
- CVE-2026-102305
Frequently Asked Questions
What access does an attacker need before this issue can be exploited?
The attacker must first have compromised the Chrome renderer process. The issue can then be triggered using a crafted HTML page to potentially execute code outside the sandbox.
Which deployments are affected?
The issue affects Google Chrome on Android before version 154.0.8037.92. The provided information does not state whether any particular Chrome configuration changes exposure.
What is the remediation?
Update Chrome on Android to version 154.0.8037.92 or later. No alternative mitigation is provided in the available information.