Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
Vulnerability1 · 1 read
CVE-2026-95306
V8 Type Confusion Enables Sandboxed Code Execution in Chrome
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A type confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome before 154.0.8037.57 allows a remote attacker to execute arbitrary code inside the browser sandbox. It is triggered when the victim loads a crafted HTML page; the advisory does not describe any further interaction. Code runs only inside the sandbox, so this is not by itself a full system compromise, but renderer code execution is still high impact and is often chained with other bugs; Chromium rated it High. Users and organizations running any Chrome version older than 154.0.8037.57 are affected. No public proof of concept is known, the issue is not in CISA’s Known Exploited Vulnerabilities catalog, and CVSS has not yet been scored.
What to do: Update Google Chrome to version 154.0.8037.57 or later and restart the browser so the fix is loaded (check chrome://settings/help). Keep automatic updates enabled, and have enterprise admins push this build promptly. Until updated, treat untrusted web pages as higher risk; this issue alone does not escape the sandbox, but it should still be patched immediately.
| Product | Affected |
|---|---|
| Google Chrome | prior to 154.0.8037.57 |
Estimated exposure
mass≈3 billion Chrome users — Google Chrome is the dominant browser, with a publicly reported global user base on the order of about 3 billion; builds before this fix are the vulnerable population until auto-update rolls out.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)