Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95281
Heap buffer overflow in Chrome for Android ANGLE enables RCE
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow (CWE-122) in the ANGLE graphics component of Google Chrome on Android, in versions prior to 154.0.8037.57, allows a remote attacker to execute arbitrary code outside the browser sandbox. The flaw is triggered when the victim loads a crafted HTML page; the advisory does not describe any further interaction. Successful exploitation breaks out of Chrome's sandbox, and Chromium rates the issue Critical. Users of Google Chrome for Android below 154.0.8037.57 are affected. No public proof-of-concept is known and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not known in the wild.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later via the Play Store or mobile device management. Until that build is installed, avoid opening untrusted web pages on affected devices and confirm managed Android fleets have received the fixed release.
| Product | Affected |
|---|---|
| Google Chrome for Android (ANGLE) | prior to 154.0.8037.57 |
Estimated exposure
masson the order of 1 billion+ Android Chrome installations still below 154.0.8037.57 until they update — Chrome is the default browser on most Android phones, a device population measured in the billions in public market figures, so installs still below the fixed 154.0.8037.57 build are a mass exposure until auto-update catches up.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
3 storiesUpdate Chrome: 108 security fixes for desktop, new release for Android
Google patched Chrome 154 for desktop with 108 fixes, including 11 rated Critical, and began a Chrome 155 Android rollout.
73
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60