CVE-2026-95357

No known exploitation. EPSS puts it in the 39th percentile. Fixed in 154.0.8037.57.

CVSS 3.19.6Critical EPSS percentile39th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix154.0.8037.57Upgrade to this build

Published 2026-09-29Updated 2026-09-30Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Google ChromeAffected: ≥ 154.0.8037.57, < 154.0.8037.57Upgrade to: 154.0.8037.57Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Open Chrome on any Android phones or tablets used for business and check the version under Settings > About Chrome.
If the version is older than 154.0.8037.57, update immediately via the Google Play Store.
Restart the browser after updating to make sure the fix is active.
Enable automatic app updates on company devices so this doesn't happen again.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

In plain language

Written by AI from the record

A serious flaw in Google Chrome on Android could let a malicious webpage break out of the browser's safety sandbox and run harmful code on the device, so every business device running an outdated Chrome should update now.

An out-of-bounds write (CWE-787) in Chrome's GPU component on Android allows a remote attacker, via a crafted HTML page, to corrupt memory and execute arbitrary code outside the browser sandbox.

If you're affected

Device takeover
Malware installation
Data theft from device
Business account compromise

What is it

Think of Chrome's sandbox as a locked room that keeps anything a webpage does safely contained. This bug lets a specially crafted webpage pick the lock and get out of that room, potentially letting an attacker run their own code on your phone or tablet just from you visiting a bad page.

Who is affected

This matters to you if anyone in your business uses Chrome on an Android phone or tablet for work — email, banking, customer apps, or general browsing. It requires the user to interact with a malicious page (such as clicking a link), but no login or special access is needed by the attacker.

How urgent is it

This is a critical sandbox-escape vulnerability with a severity rating Google itself calls Critical, meaning a single malicious webpage could fully compromise an Android device. There's no confirmed active exploitation or public exploit code yet, but the ease of delivery (just visiting a crafted page) and the severity of what an attacker gains mean this should be treated as urgent and patched without delay, not scheduled for later.

What to do — in detail

Confirm exposure by checking the Chrome version on all Android devices used for business (Settings > About Chrome); any version prior to 154.0.8037.57 is vulnerable. Update to 154.0.8037.57 or later via the Play Store or your mobile device management (MDM) tool — this is a drop-in upgrade with no breaking changes expected for typical use. If you manage devices centrally, push the update via MDM policy and verify compliance across the fleet. There is no practical workaround short of updating or disabling JavaScript/GPU acceleration (not recommended, breaks most sites), so prioritize the patch. No CISA KEV due date applies since it's not yet in the Known Exploited Vulnerabilities catalog, but monitor Chrome release notes and Chromium security bulletins for any update indicating active exploitation, which would elevate urgency further.

Technical context

CVSS 9.6 (Critical), AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — network-exploitable, low complexity, no privileges required, but requires user interaction (visiting a crafted page); scope change reflects the sandbox escape. Weakness type is CWE-787 (out-of-bounds write) in the GPU process. Not listed in CISA KEV, no public exploit code identified, and EPSS predicts low near-term exploitation likelihood. Press attention is limited to routine vulnerability-roundup coverage rather than active-exploitation reporting. Fixed in Chrome 154.0.8037.57.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 1 day, from the signal feeds we watch.

2026-09-30Patch availablerecord updated, record updated
2026-09-29Publishedweakness classified, att&ck mapped, record updated

Affected products

Googlecommercial · USaka google inc, google llc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Scored 9.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable