Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
Vulnerability2 · 1 read
CVE-2026-95356
Use-After-Free Sandbox Escape in Google Chrome WindowDialog
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Google Chrome versions before 154.0.8037.57 have a use-after-free flaw (CWE-416) in the WindowDialog component, rated Critical by Chromium. A remote attacker who uses social engineering to get a victim to open a crafted HTML page can trigger the bug and potentially run arbitrary code outside the browser sandbox. Anyone still running an unpatched Chrome release is affected. CVSS has not been scored, no public proof-of-concept is known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Update Google Chrome to version 154.0.8037.57 or later and fully restart the browser so the update takes effect. Until then, avoid opening untrusted links or HTML pages, and have enterprise admins push the fixed build through managed update channels and confirm the running version afterward.
| Product | Affected |
|---|---|
| Google Chrome | prior to 154.0.8037.57 |
Estimated exposure
mass≈2–3 billion Chrome users/installations on builds before 154.0.8037.57 — Google Chrome has a publicly reported global user base on the order of billions and the dominant desktop browser share, and this bug affects every release before the fixed build, so nearly the entire installed base is plausibly exposed…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
2 storiesChrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60