Skip to content
NewA calmer, faster ZeroHour
Vulnerability1 · 1 read

CVE-2026-95313

Use-after-free in Google Chrome Fullscreen enables sandbox escape

CVSS 3.1
9.6 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-95313 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Google Chrome versions before 154.0.8037.57 contain a use-after-free flaw (CWE-416) in the Fullscreen component. A remote attacker can trigger it by getting a user to open a crafted HTML page. Successful exploitation can potentially execute arbitrary code outside the browser sandbox, and Chromium rates the issue Critical. Anyone still running an unpatched Chrome build is affected. No public proof-of-concept is known, the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, and CVSS has not yet been scored.

What to do: Update Google Chrome to version 154.0.8037.57 or later and fully restart the browser so the update is applied. Until then, avoid opening untrusted HTML pages, and confirm the running build under Help > About Google Chrome or chrome://settings/help.

ProductAffected
Google Chromeprior to 154.0.8037.57
Estimated exposure
mass≈2–3 billion Chrome users (all installs before 154.0.8037.57) — Google Chrome is the dominant browser, with a publicly reported global user base on the order of billions; every installation still running a build before 154.0.8037.57 is in scope.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Vendors
google
Products
chrome
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories