Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95339
Use-after-free in Chrome ServiceWorker enables sandbox escape
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-95339 is a critical use-after-free (CWE-416) in the ServiceWorker component of Google Chrome before version 154.0.8037.57. A remote attacker can trigger it by getting a user to open a crafted HTML page, then execute arbitrary code outside the browser sandbox. Impact is high for confidentiality, integrity, and availability, with a changed security scope (CVSS 3.1 9.6; user interaction required, no privileges). Anyone still running Chrome earlier than 154.0.8037.57 is affected. No public proof of concept is known and the flaw is not in CISA KEV, so exploitation in the wild is not known.
What to do: Update Google Chrome to version 154.0.8037.57 or later and fully restart the browser so the patched build is actually running. Enterprises should push the update through managed browser policies and confirm clients are no longer on builds before 154.0.8037.57. Until then, limit browsing of untrusted pages, since the flaw is triggered by a crafted HTML page.
| Product | Affected |
|---|---|
| Google Chrome | prior to 154.0.8037.57 |
Estimated exposure
massbillions of Chrome installations worldwide — Google Chrome is the dominant desktop and mobile browser, with a majority of global market share and on the order of billions of users, so unpatched builds before 154.0.8037.57 plausibly affect a mass population until they update.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60