Tools AI-Found Vulnerability Register aifv-0074
Register entry
Chrome V8 type confusion, reported by OpenAI Codex Security
- CVE
- CVE-2026-102326
- Project
- Google Chrome
- Component
- V8
- Finder
- OpenAI Codex Security
- Autonomy
- credited to the product with a person's handle in brackets; the split between agent and person is unstated
- Evidence tier
- CNA credits the finder in its own advisory
- Assigner
- Chrome
- Severity
- High (Chromium severity)
- Bounty
- Chrome Vulnerability Reward Program
- Confidence
- CONFIRMED
What happened
A high-severity type confusion in Chrome's V8, fixed in Chrome 154.0.8037.92 and credited to OpenAI Codex Security in the Stable Channel Update of 29 September 2026. It was reported to Chrome on 11 September 2026. The CVE record says it allowed a remote attacker to run code inside the sandbox through a crafted HTML page.
Credit as recorded: High CVE-2026-102326: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-11. The CVE record's credits field is empty, so the attribution rests on Chrome's release note, where the reward column reads TBD. Codex Security is the OpenAI product the Aardvark rows on this tracker became in March 2026. Chrome's stable updates of 8, 22 and 29 September 2026 carry this credit on six fixes. Date basis: release note.
Sources
- CVE record, cvelistV5 mirrorraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Chrome Releases, Stable Channel Update, 29 September 2026chromereleases.googleblog.com/2026/09/stable-channel-update-…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 8 October 2026