Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-95349: Chrome on Android before version 154 allows remote code execution
CVE-2026-95349 · published 2 days ago
Summary
The web browsing component in Google Chrome for Android, as packaged in Debian's Chromium, can be tricked by a specially crafted web page to run code outside its normal safety limits. This could let an attacker take control of the device or access data. Install the latest Chrome/Chromium update (version 154.0.8037.57 or newer) to eliminate the risk.
What to do
- Update debian chromium to version 154.0.8037.57-1~deb13u1.
- Update debian chromium to version 154.0.8037.57-1.
- Update google chrome to version 154.0.8037.57 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium |
< 154.0.8037.57-1~deb13u1 Fix: upgrade to 154.0.8037.57-1~deb13u1
|
| Debian:14 | debian | chromium |
< 154.0.8037.57-1 Fix: upgrade to 154.0.8037.57-1
|
| – | chrome | < 154.0.8037.57 |
Original advisory text
DEBIAN-CVE-2026-95349
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.6
Critical
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published29 Sep 2026
Updated1 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta