Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
Vulnerability2 · 1 read
CVE-2026-95304
Out-of-bounds write in Chrome V8 allows sandboxed code execution
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-95304 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine used by Google Chrome before 154.0.8037.57. A remote attacker can trigger it by getting a user to open a crafted HTML page, then execute arbitrary code inside Chrome's sandbox. Chromium rates the issue High; the description does not indicate a sandbox escape, so the immediate impact is code execution confined to the renderer sandbox. Anyone still running Google Chrome older than 154.0.8037.57 is affected. No public proof of concept is known and the CVE is not on CISA's Known Exploited Vulnerabilities list, so exploitation is not known at this time.
What to do: Update Google Chrome to version 154.0.8037.57 or later on all devices and restart the browser so the fix is loaded. Prefer automatic updates and confirm the running version in chrome://settings/help. Treat unpatched browsers as exposed to drive-by attacks from malicious or compromised web pages until they are updated.
| Product | Affected |
|---|---|
| Google Chrome | prior to 154.0.8037.57 |
Estimated exposure
masson the order of 2–3 billion Chrome users worldwide — Google Chrome is the dominant desktop and mobile browser; public user and market-share figures put the install base on the order of a few billion people, and every build before 154.0.8037.57 is in the affected range until updated.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)