Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95350
Heap buffer overflow in Google Chrome ANGLE on Android
- CVSS 3.1
- 9.6 critical
- EPSS
- <1%p45
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow (CWE-122) in ANGLE, Chromium’s graphics translation layer, affects Google Chrome on Android before version 154.0.8037.57. A remote attacker can trigger it by convincing a user to open a crafted HTML page; no privileges are required and attack complexity is low. Successful exploitation allows arbitrary code execution outside the browser sandbox, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 9.6; Chromium severity Critical). Users of unpatched Chrome on Android are affected. No public proof of concept is known and the issue is not in CISA’s Known Exploited Vulnerabilities catalog, so exploitation is not known to be occurring in the wild.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later via the Google Play Store and confirm the installed version afterward. Until devices are updated, avoid opening untrusted or unexpected web pages. Prioritize this critical sandbox-escape fix on managed Android fleets; no public exploit is known.
| Product | Affected |
|---|---|
| Google Chrome for Android | prior to 154.0.8037.57 |
Estimated exposure
masson the order of 1 billion+ Android Chrome users before patching — Chrome is the dominant browser on Android, which has a multi-billion-device installed base, so builds before 154.0.8037.57 plausibly cover on the order of a billion users; this estimates the pre-patch population, not a count of devices…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
3 storiesUpdate Chrome: 108 security fixes for desktop, new release for Android
Google patched Chrome 154 for desktop with 108 fixes, including 11 rated Critical, and began a Chrome 155 Android rollout.
73
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60