Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-103630

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 154.0.8037.97
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected versions

  • Google Chrome

    From 154.0.8037.97 · fixed in 154.0.8037.97

References 2

chromereleases.googleblog.com

issues.chromium.org