Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
Vulnerability5 · 1 read
CVE-2026-95284
Critical heap buffer overflow in Chrome ANGLE on Android
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow (CWE-122) in ANGLE, Chrome’s graphics translation layer, affects Google Chrome on Android before version 154.0.8037.57. A remote attacker can trigger it by getting the user to open a crafted HTML page and can then execute arbitrary code outside the browser sandbox. Google rates the issue Critical. Unpatched Chrome-for-Android installations are broadly exposed because Chrome is the default browser on most Android devices. No public proof of concept is known, the flaw is not in CISA’s Known Exploited Vulnerabilities catalog, and exploitation in the wild is not reported.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later through the Google Play Store or the device system-update channel, then fully restart the browser. Until that version is installed, avoid opening untrusted or unexpected web pages. Confirm the running build in Chrome settings or at chrome://version.
| Product | Affected |
|---|---|
| Google Chrome for Android | prior to 154.0.8037.57 |
Estimated exposure
masshundreds of millions to over 1 billion Android Chrome installations (order-of-magnitude estimate) — Chrome is the default browser on most Android devices and has a multi-billion global user base; the CVE data gives no scan or install count, so this is an order-of-magnitude estimate from that deployment pattern of devices that could still…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60