Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95349
Heap Buffer Overflow in Chrome for Android WebGL
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow (CWE-122) in the WebGL component of Google Chrome on Android, in versions before 154.0.8037.57, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The flaw is triggered when the browser processes a crafted HTML page that exercises the vulnerable WebGL code. Successful exploitation could break out of Chrome's sandbox, which Google rates as Critical. Anyone still running an unpatched Chrome build on Android is affected. No public proof of concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later through the Google Play Store or Chrome's built-in updater, then confirm the version under Settings > About Chrome. Until that build is installed, avoid opening untrusted web pages, especially pages that use WebGL. Enterprises should push the fixed version through mobile device management and verify devices are no longer running earlier Chrome builds.
| Product | Affected |
|---|---|
| Google Chrome for Android | prior to 154.0.8037.57 |
Estimated exposure
masson the order of hundreds of millions to over 1 billion Android Chrome installations — Chrome is the default browser on most Android devices, and public market figures put its mobile user base well above one billion, so builds before 154.0.8037.57 plausibly cover a mass population until they are updated.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60