Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-95311: Chrome on Debian may run code from malicious web page
CVE-2026-95311 · published 2 days ago
Summary
Google Chrome and the Chromium browser included in Debian can be tricked by a specially crafted web page to run code on the computer, bypassing the normal protection sandbox. This could let an attacker take control of the system if a user is persuaded to visit the page. Update Chrome/Chromium to the latest version as soon as possible to fix the issue.
What to do
- Update debian chromium to version 154.0.8037.57-1~deb13u1.
- Update debian chromium to version 154.0.8037.57-1.
- Update google chrome to version 154.0.8037.57 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium |
< 154.0.8037.57-1~deb13u1 Fix: upgrade to 154.0.8037.57-1~deb13u1
|
| Debian:14 | debian | chromium |
< 154.0.8037.57-1 Fix: upgrade to 154.0.8037.57-1
|
| – | chrome | < 154.0.8037.57 |
Original advisory text
DEBIAN-CVE-2026-95311
Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.6
Critical
Type
CWE-590Free of Memory not on the Heap
Timeline
Published29 Sep 2026
Updated1 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta