Google Chrome CVE-2026-102309

Requires the victim to load attacker-controlled content in Chrome - specifically a crafted HTML page that exercises the FullScreen feature to trigger the use-after-free (UI:R: user must navigate to the page). No authentication is required (PR:N) and the attack is fully remote (AV:N) against default Chrome configurations, since FullScreen is a standard built-in browser capability requiring no special setting. The primary limiting factor is the need for user interaction (visiting the page) and that versions at or above 154.0.8037.92 are patched; there is no known active exploitation (SSVC Exploitation: none) and the attack is not automatable for mass exploitation.

This is a high-priority vulnerability by technical severity: CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a scope-changing use-after-free that explicitly permits code execution OUTSIDE the Chrome renderer sandbox - a sandbox escape, which is why S:C and all-High impact apply. The only mitigating base metric is UI:R (victim must open/interact with a crafted page). Countervailing signals temper urgency: CISA SSVC lists Exploitation as 'none' (no observed exploitation), Automatable 'no' (drive-by requires user navigation, not scriptable mass-exploitation), though Technical Impact is 'total' (consistent with full RCE). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is currently a patch-and-move-on issue rather than an actively-exploited emergency. Note the description says 'execute arbitrary code outside the sandbox' (true RCE-class), which is more severe than a typical renderer-only UAF and justifies the S:C rating over the S:U seen in many sibling Chrome UAFs.

An attacker crafts a malicious HTML page that abuses Chrome's FullScreen handling to trigger a use-after-free, then lures a victim to visit it (malvertising, phishing link, or compromised site). Because the flaw permits execution outside the sandbox, successful exploitation yields arbitrary code execution on the victim host with the browser user's privileges. No public exploit is identified at time of analysis, and exploitation requires the user to navigate to the page (UI:R).