Google Chrome CVE-2026-102329

Exploitation requires the victim to load attacker-controlled crafted HTML in Chrome versions prior to 154.0.8037.92 (UI:R). The attacker must craft content that abuses the WebUI flaw to bypass the web origin policy and reach a privileged internal page (chrome:// WebUI). Limiting factors: no authentication is needed (PR:N) but user interaction is mandatory, the target must be running an unpatched Chrome build, and the payload must specifically target the vulnerable WebUI surface rather than ordinary web content; there is no confirmed availability impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a remote, unauthenticated, low-complexity XSS that requires user interaction (visiting a crafted HTML page) and involves a scope change (S:C) - the attacker breaks out of normal web content into a privileged Chrome WebUI (chrome://) page, which is the defining risk of this bug class. Confidentiality and integrity impacts are rated Low and availability None, so the raw score is moderate rather than critical. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' Google/Chromium rated the Chromium security severity as High, which reflects the privilege-boundary bypass potential more than the CVSS numeric would suggest; WebUI XSS can be a stepping stone toward more powerful chrome:// bindings. On balance this is a real but interaction-gated browser patch-cycle issue: prioritize routine Chrome updating rather than emergency response, absent evidence of active exploitation. No conflicting signals were found between the vector and the description - both indicate remote delivery with required user interaction.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it; the page exploits the WebUI flaw to bypass the web origin policy and inject script that executes in the context of a privileged Chrome page. No public exploit code is identified at time of analysis, and successful attack requires the victim to load the malicious content (UI:R).