CVE-2026-102327 is an incorrect authorization vulnerability in the WebView component of Google Chrome on Android versions before 154.0.8037.92. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction and high attack complexity.

Successful exploitation could allow an attacker to execute arbitrary code outside the sandbox on the affected device, potentially leading to full compromise of the browser process and access to sensitive information or system control. The vulnerability requires that the attacker has already compromised the renderer process and user interaction is needed to trigger the exploit.

A fix is available in Google Chrome version 154.0.8037.92. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html for more details.