Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95322
GPU out-of-bounds write sandbox escape in Chrome on Android
- CVSS 3.1
- 8.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-95322 is a critical out-of-bounds write (CWE-787) in the GPU component of Google Chrome on Android. A remote attacker who has already compromised the renderer process can trigger the flaw with a crafted HTML page and execute arbitrary code outside the sandbox. It affects Google Chrome on Android in versions prior to 154.0.8037.57. This is a sandbox escape rather than a standalone browser compromise, but Chromium rates it Critical because successful exploitation yields code execution beyond the renderer sandbox. No public proof of concept is known and the issue is not listed in CISA KEV, so exploitation status is none known.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later via the Google Play Store and confirm the running version in Chrome settings. Prioritize devices that browse untrusted sites, since this is a critical sandbox escape even though it requires a prior renderer compromise. No public exploit is known, but do not delay the update.
| Product | Affected |
|---|---|
| Google Chrome on Android | prior to 154.0.8037.57 |
Estimated exposure
mass≈1 billion+ Chrome for Android installations (until updated to 154.0.8037.57) — Chrome is the default or preinstalled browser on most Android devices, and Google has reported billions of Chrome users with Android accounting for the large majority of that base, so unpatched installs are plausibly in the hundreds of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60