Google Chrome 154.0.8037.57 Fixes Eight Vulnerabilities, Including Two Critical/High-Severity Sandbox Escapes

What Happened

Google released a Stable Channel update for Chrome (desktop) and a corresponding Android update bringing both to version 154.0.8037.57. The update resolves eight separate vulnerabilities: two buffer overflows (CVE-2026-95283, CVE-2026-95350) specific to Chrome on Android, three use-after-free or type-confusion memory safety issues affecting the browser generally (CVE-2026-95345, CVE-2026-95282, CVE-2026-95306, CVE-2026-95380), a cross-site request forgery issue in DevTools (CVE-2026-95362), and an inappropriate implementation issue in XML handling (CVE-2026-95369). All issues were disclosed via Google's Chrome Releases blog alongside NVD database entries.

Technical Cause

The vulnerabilities stem from several distinct underlying bug classes. CVE-2026-95283 (CWE-122, buffer overflow in 'Tint') and CVE-2026-95350 (CWE-122, buffer overflow in 'ANGLE') are both memory corruption issues specific to the Android build of Chrome. CVE-2026-95345 (CWE-416, use after free in 'Actor') and CVE-2026-95282 (CWE-416, use after free in 'Platform') involve memory being accessed after it has been freed. CVE-2026-95306 and CVE-2026-95380 (both CWE-843, type confusion in 'V8') relate to the JavaScript engine treating data as an incorrect type. CVE-2026-95369 (CWE-841, inappropriate implementation in 'XML') involves flawed logic in XML processing. CVE-2026-95362 (CWE-352, cross-site request forgery in DevTools) allows an attacker to bypass the web origin policy. All of the memory-safety and logic issues are reachable via a crafted HTML page; the DevTools issue additionally requires social engineering to trick a user into an action.

Why It Matters

Several of these vulnerabilities carry a CVSS base score of 9.6 or 8.8, indicating high-impact, network-exploitable issues requiring only user interaction (e.g., visiting a malicious page) and no privileges. The two Android-specific buffer overflow issues (CVE-2026-95283 and CVE-2026-95350) are particularly notable because successful exploitation is described as allowing code execution outside the browser's sandbox — meaning an attacker could potentially affect the device beyond the browser process itself. CVE-2026-95350 was rated 'Critical' by Chromium's own internal severity classification. The remaining memory-safety bugs allow code execution inside the sandbox, which is a serious issue but contained by Chrome's sandboxing architecture. The DevTools CSRF issue (CVE-2026-95362) could let an attacker bypass the web origin policy through social engineering.

Who Is Affected

All users running Google Chrome versions prior to 154.0.8037.57 are affected. Two of the eight vulnerabilities (CVE-2026-95283 and CVE-2026-95350) are specific to Chrome on Android; the remaining six affect Chrome generally, which includes the desktop channel referenced in the vendor's Stable Channel Update announcement.

Affected Versions

All versions of Google Chrome prior to 154.0.8037.57 are affected by at least one of the eight described vulnerabilities. The fact package does not specify a lower bound for the affected version range, so users on any earlier release should assume exposure and update promptly.

Fixes and Mitigation

Google has released Chrome version 154.0.8037.57, which contains fixes for all eight vulnerabilities described in this briefing. No workarounds or mitigations other than updating are described in the available source material.

Recommended Action

Update Google Chrome to version 154.0.8037.57 or later as soon as possible, on both desktop and Android. Chrome typically updates automatically, but users and administrators should verify the installed version via the browser's About page and restart the browser to apply the update. Organizations managing Chrome deployments at scale should confirm that the update has propagated across all endpoints.