Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
85
CVE-2026-95357
GPU out-of-bounds write in Chrome for Android
- CVSS 3.1
- 9.6 critical
- EPSS
- <1%p40
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-95357 is a critical out-of-bounds write (CWE-787) in the GPU component of Google Chrome on Android, fixed in 154.0.8037.57. A remote attacker can trigger it by convincing a user to open a crafted HTML page; no prior privileges are required and attack complexity is low. Successful exploitation can potentially run arbitrary code outside the Chrome sandbox, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 9.6, scope changed). Everyone running Chrome for Android older than 154.0.8037.57 is affected. It is not listed in CISA KEV, and no public proof-of-concept is known, so exploitation is none_known at this time.
What to do: Update Google Chrome on Android to version 154.0.8037.57 or later through the Play Store or the browser's update prompt, and confirm the installed build before browsing. Until the update is applied, avoid opening untrusted or unexpected HTML pages. There is no public patch workaround; upgrading is the fix.
| Product | Affected |
|---|---|
| Google Chrome for Android | prior to 154.0.8037.57 |
Estimated exposure
masson the order of 100 million to 1 billion+ Android Chrome installations until updated — Chrome is the dominant browser on Android, with on the order of a billion-plus installations worldwide; devices that have not yet received 154.0.8037.57 remain in the vulnerable set, so exposure is mass-scale even after accounting for…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
In the news
3 storiesUpdate Chrome: 108 security fixes for desktop, new release for Android
Google patched Chrome 154 for desktop with 108 fixes, including 11 rated Critical, and began a Chrome 155 Android rollout.
73
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60