Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Chrome before 154.0.8037.97 lets malicious page run code

CVE-2026-103628 · published 1 month ago
Summary

Google Chrome versions older than 154.0.8037.97 can be tricked by a specially crafted web page to write data outside its safe memory area, which may let an attacker run programs on a user’s computer. This bypasses Chrome’s sandbox protection, potentially exposing the system to malware. Updating Chrome to version 154.0.8037.97 or later fixes the issue.

What to do
  • Update google chrome to version 154.0.8037.97 or later.
Affected software
VendorProductAffected versions
google chrome < 154.0.8037.97
Original advisory text
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Cr...
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published2 Oct 2026
Updated4 Nov 2026
First seen2 Oct 2026
Sources
CVE-2026-103628 · NVD
CVE-2026-103628 · MITRE
Track software like this
Free during beta