CVE-2026-95350

No known exploitation. EPSS puts it in the 42nd percentile. Fixed in 154.0.8037.57.

CVSS 3.19.6Critical EPSS percentile42nd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix154.0.8037.57Upgrade to this build

Published 2026-09-29Updated 2026-09-30Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Google ChromeAffected: ≥ 154.0.8037.57, < 154.0.8037.57Upgrade to: 154.0.8037.57Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether any work phones, tablets, or BYOD devices use Chrome on Android for business tasks.
Open Chrome's settings menu and check the version number shown under 'About Chrome'.
If the version is older than 154.0.8037.57, update Chrome immediately via the Google Play Store.
Enable automatic updates for Chrome on all business Android devices going forward.
Remind staff not to open suspicious links until the update is confirmed installed.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

In plain language

Written by AI from the record

A serious flaw in Chrome's graphics code on Android could let an attacker take over a device just by getting someone to open a malicious webpage, so this should be fixed right away even though there's no sign yet of it being used in attacks.

Critical heap buffer overflow (CWE-122) in Chrome's ANGLE graphics layer on Android allows a remote attacker to achieve sandbox-escaping arbitrary code execution via a crafted HTML page with only user interaction (visiting the page) required.

If you're affected

Full device compromise
Malware or spyware installation
Customer data exposure
Operational disruption from compromised devices

What is it

Think of Chrome's graphics engine as the part of the browser that draws what you see on a webpage. This bug lets a specially crafted page overload that drawing code so badly that it spills over into other parts of the phone's memory, giving an attacker a way to run their own code - essentially handing them control of the device just by you looking at a page.

Who is affected

This matters to you if your business uses Chrome on Android phones or tablets - whether company-owned devices or employees' personal phones used for work (BYOD). The attack only requires a user to open a crafted webpage in Chrome; no special access or login is needed, but the person does have to visit the malicious page.

How urgent is it

This is rated critical because it allows an attacker to break out of Chrome's security sandbox and run arbitrary code on the device using nothing more than a malicious webpage - a very high-impact outcome. There's no confirmed active exploitation or public exploit code yet, but the severity and ease of triggering (just opening a page) mean it should be treated as an immediate priority rather than something to defer.

What to do — in detail

Confirm exposure by inventorying Android devices running Chrome for business purposes (both managed/MDM-enrolled and BYOD) and checking their installed version against 154.0.8037.57. Google has released the fix in stable channel update 154.0.8037.57 for Android - push this update via your mobile device management (MDM) platform if you manage devices centrally, or require manual updates via Google Play otherwise. There is no special upgrade path or breaking-change concern here; it's a standard Chrome point release. A temporary workaround/tracking issue is available at https://issues.chromium.org/issues/551573368 for reference, but the practical mitigation is to update as soon as possible - there is no meaningful compensating control for a renderer sandbox-escape bug short of restricting Chrome use. Monitor the Chrome release blog (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html) for any amendments, and watch for this CVE appearing in CISA's KEV catalog or exploit code being published, which would elevate urgency further.

Technical context

CVSS 9.6 (Critical), AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - network-exploitable, low complexity, no privileges required, requires user interaction, with a scope change (sandbox escape) and full impact to confidentiality, integrity, and availability. Weakness is CWE-122 (heap-based buffer overflow) in the ANGLE graphics translation layer used by Chrome on Android. Not currently in CISA's KEV catalog, no public exploit code has been identified, and EPSS places predicted near-term exploitation likelihood on the lower end with a flat trend - but CVSS severity and sandbox-escape capability justify treating this as urgent pending any exploitation signal. Press attention so far is limited to routine vulnerability roundup coverage, not evidence of active attacks.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS42nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 42nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 1 day, from the signal feeds we watch.

2026-09-30Patch availableworkaround available, record updated, record updated
2026-09-29Publishedweakness classified, att&ck mapped, record updated

Affected products

Googlecommercial · USaka google inc, google llc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Scored 9.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable