CVE-2026-102324 is a use-after-free vulnerability in the PictureInPicture component of Google Chrome versions before 154.0.8037.92. Exploitation requires that the attacker has already compromised the renderer process and can deliver a specially crafted HTML page to trigger arbitrary code execution outside the sandbox. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor has published a stable channel update to address this issue.

Successful exploitation allows remote code execution outside the sandbox from the renderer process, potentially compromising the host system's security. The vulnerability affects confidentiality, integrity, and availability with high impact. However, exploitation requires prior compromise of the renderer process and user interaction.

Google has released an official fix in Chrome version 154.0.8037.92. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.