Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Chrome on Android may run attacker code

CVE-2026-95329 · published 2 days ago
Summary

Older versions of Chrome for Android could be tricked by a specially crafted web page to execute code outside its normal protection. This could let an attacker take control of the device. Update Chrome to the latest version and keep your Android system current to protect against this risk.

What to do
  • Update debian chromium to version 154.0.8037.57-1~deb13u1.
  • Update debian chromium to version 154.0.8037.57-1.
  • Update google chrome to version 154.0.8037.57 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chromium All versions
Debian:13 debian chromium < 154.0.8037.57-1~deb13u1
Fix: upgrade to 154.0.8037.57-1~deb13u1
Debian:14 debian chromium < 154.0.8037.57-1
Fix: upgrade to 154.0.8037.57-1
– google chrome < 154.0.8037.57
Original advisory text
DEBIAN-CVE-2026-95329
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published29 Sep 2026
Updated1 Oct 2026
First seen23 Sep 2026
Sources
DEBIAN-CVE-2026-95329 · OSV
CVE-2026-95329 · NVD
CVE-2026-95329 · MITRE
Track software like this
Free during beta