Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
Vulnerability2 · 1 read
CVE-2026-95329
Out-of-bounds write in Chrome Android WebGL enables sandbox escape
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-95329 is a critical out-of-bounds write (CWE-787) in the WebGL component of Google Chrome on Android, in versions prior to 154.0.8037.57. A remote attacker can trigger it by convincing a user to open a crafted HTML page, and successful exploitation may allow arbitrary code execution outside the browser sandbox. The issue is limited, based on the advisory, to Chrome on Android before that fixed build. It is not listed in the CISA Known Exploited Vulnerabilities catalog, has no known public proof-of-concept, and there is no confirmed in-the-wild exploitation. Google has shipped the fix in Chrome 154.0.8037.57 as part of a broader Chrome security update.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later through the Play Store or your device's update mechanism. Treat this as urgent because the flaw is rated Critical and can lead to code execution outside the sandbox from a malicious web page. There is no indication of a public proof-of-concept or active exploitation, but unpatched Android Chrome users should still update promptly and avoid untrusted sites until the fix is installed.
| Product | Affected |
|---|---|
| Google Chrome for Android | prior to 154.0.8037.57 |
Estimated exposure
masshundreds of millions to over 1 billion Android Chrome installations (order-of-magnitude estimate from Android/Chrome market reach) — Chrome is the default browser on most Android devices, and public market figures put active Android devices and Chrome mobile users in the billions, so installations still on a build before 154.0.8037.57 are plausibly in the hundreds of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60