CVE-2026-102327
published 2026-09-29CVE-2026-102327: Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to…
PriorityP345high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.27%
18.7th percentile
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 154.0.8037.92 | 154.0.8037.92 | |
| chrome | >= 154.0.8037.92 < 154.0.8037.92 | 154.0.8037.92 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
vendor_paloalto·2026-10-14·CVSS 9.6
CVE-2026-85042 [CRITICAL] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-de
Chrome
Stable Channel Update for Desktop: CVE-2026-102310
vendor_chrome·2026-09-29·CVSS 7.5
CVE-2026-102310 [LOW] Stable Channel Update for Desktop: CVE-2026-102310
Stable Channel Update for Desktop
CVE-2026-102310: Missing authorization in Payments. Reported by Autodidact on 2026-01-22 [N/A][ 496212975 ] Low CVE-2026-102327: Incorrect authorization in WebView
Reported by Google on 2026-03-25 [N/A][ 498793976 ] Low CVE-2026-102330: Incorrect authorization in SiteIsolation
Severity: low
Red Hat
chromium-browser: chromium-browser: Incorrect authorization in WebView
vendor_redhat·2026-09-29·CVSS 7.5
CVE-2026-102327 [HIGH] CWE-653 chromium-browser: chromium-browser: Incorrect authorization in WebView
chromium-browser: chromium-browser: Incorrect authorization in WebView
An incorrect authorization flaw was found in the WebView component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=496212975
https://code.google.com/p/chromium/issues/detail?id=102327
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
VulDB
Google Chrome up to 154.0.8037.57 WebView improper authorization (WID-SEC-2026-3648)
vuldb·2026-10-03·CVSS 7.5
CVE-2026-102327 [HIGH] Google Chrome up to 154.0.8037.57 WebView improper authorization (WID-SEC-2026-3648)
A vulnerability was found in Google Chrome. It has been classified as critical. Affected by this issue is some unknown functionality of the component WebView. The manipulation leads to improper authorization.
This vulnerability is documented as CVE-2026-102327. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outsid
ghsa_unreviewed·2026-09-29
CVE-2026-102327 [HIGH] CWE-863 Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outsid
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
No detection rules found.
No public exploits indexed.
2026-09-29
Published