Google · Memory corruption
Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
At a glance
~0.3% estimated chance of attack in 30 days. Exploitation not confirmed.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run Google Chrome, and which versions?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-102304- 9.6 · CriticalExploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Not listed
- ~0.3% estimated chance of attack in 30 days
- Before 154.0.8037.92
- 154.0.8037.92
These facts are for CVE-2026-102304. This event covers 63 more CVEs, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- CVE-2026-103623 has an estimated ~0.3% chance of attack in 30 days (22.8th percentile) as of 2026-10-26 — probability signal, not confirmed exploitation
- Exploitation in the wild is not confirmed; treat this as a prioritisation signal.
Products and services involved
- Google Chrome93% match confidence · CVE-2026-102304
Pulse
Last checked 31 Oct · Recheck overdue since 1 Nov 2026, 05:07 UK time
- Story27 Oct 2026, 05:10 UK time · 27 Oct
Linked reporting from Chrome Releases (vendor psirt).
Read source (Chrome Releases) - Update27 Oct 2026, 05:18 UK time · 27 Oct
in the next 30 days first recorded at 0.3% (lower likelihood signal, not confirmed exploitation).
- Signal31 Oct 2026, 05:07 UK time · 31 Oct
in the next 30 days rose from 0.3% to 0.5%.
3 entries so far. The timeline chart appears once this story has more history.
Sources
- Chrome ReleasesVendor
Long Term Support Channel Update for ChromeOS
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102304
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102306
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102308
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102316
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102319
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102324
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-103622
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-103623
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-103623 has an estimated ~0.3% chance of attack in 30 days (22.8th percentile) as of 2026-10-26 — probability signal, not confirmed exploitation
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-103629
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-106184