Update Chrome: Google fixes 37 security flaws, including seven critical bugs
Google patched 37 Chrome flaws, including seven critical bugs that can enable remote code execution.
78
CVE-2026-110152
Heap buffer overflow in Chrome ANGLE on Android
- CVSS 3.1
- 9.6 critical
- EPSS
- <1%p44
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow (CWE-122) in ANGLE, Chromium’s graphics translation layer, affects Google Chrome on Android before version 155.0.8059.79. A remote attacker can trigger it by getting a user to open a crafted HTML page; no privileges are required beyond that interaction. Successful exploitation may allow arbitrary code execution outside the browser sandbox, with high impact on confidentiality, integrity, and availability (CVSS 3.1 9.6; Chromium severity Critical). Anyone still running an older Chrome build on Android is affected. No public proof of concept is known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Update Google Chrome on Android to version 155.0.8059.79 or later via the Play Store or the device update mechanism, then confirm the installed version in Chrome settings. Until that build is installed, avoid opening untrusted or unexpected web pages on affected devices.
| Product | Affected |
|---|---|
| Google Chrome | Android builds prior to 155.0.8059.79 |
Estimated exposure
masshundreds of millions to over 1 billion Android Chrome users (order of magnitude; share still below 155.0.8059.79 unknown) — Chrome is the default browser on most Android phones, and the global Android installed base is well over one billion active devices, so users still on builds before 155.0.8059.79 are plausibly a mass population even though the exact…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)