Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-95357: Chrome on Android can run malicious code via web page
CVE-2026-95357 · published 2 days ago
Summary
The Chrome browser on Android devices (including the Debian Chromium package) can be tricked by a specially crafted web page to write data outside its safe memory area. This could let an attacker run code on the device, bypassing security protections. Update Chrome/Chromium to the latest version as soon as possible to close the issue.
What to do
- Update debian chromium to version 154.0.8037.57-1~deb13u1.
- Update debian chromium to version 154.0.8037.57-1.
- Update google chrome to version 154.0.8037.57 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium |
< 154.0.8037.57-1~deb13u1 Fix: upgrade to 154.0.8037.57-1~deb13u1
|
| Debian:14 | debian | chromium |
< 154.0.8037.57-1 Fix: upgrade to 154.0.8037.57-1
|
| – | chrome | < 154.0.8037.57 |
Original advisory text
DEBIAN-CVE-2026-95357
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.6
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published29 Sep 2026
Updated1 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta