Google Chrome 154.0.8037.57 Fixes Eight Vulnerabilities Across Desktop, Android, and iOS

Overview of the Fixed Vulnerabilities

This update resolves eight distinct vulnerabilities in Google Chrome, each tracked under its own CVE identifier: - CVE-2026-95328: A confused deputy issue in Chrome's Mobile component on Android, allowing a local attacker using social engineering to obtain sensitive information via a co-installed app. - CVE-2026-95327: An information leak in Chrome's Networking component, allowing a remote attacker to leak sensitive information via a crafted HTML page. - CVE-2026-95385: An inappropriate implementation in Chrome's PlatformIntegration component on Windows, allowing a remote attacker using social engineering to bypass system access restrictions via a crafted HTML page. - CVE-2026-95275: An incorrect reference resolution in Chrome's MediaStream component, allowing a remote attacker to bypass the web origin policy into a privileged page via a crafted HTML page. - CVE-2026-95375: An incorrect authorization issue in Chrome's BrowserTag component, allowing a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. - CVE-2026-95363: A UI misrepresentation in Chrome's FileSystem component, allowing a remote attacker using social engineering to spoof UI elements via a crafted HTML page. - CVE-2026-95323: A UI misrepresentation in Chrome on iOS, allowing a remote attacker using social engineering to spoof the address bar via a crafted HTML page. - CVE-2026-95279: A UI misrepresentation in Chrome's Omnibox component on Android, allowing a remote attacker to spoof the address bar via a crafted HTML page.

Technical Root Causes

The vulnerabilities stem from different underlying weaknesses across Chrome components. These include a confused deputy pattern (CWE-441) in the Mobile component, an information exposure issue (CWE-200) in Networking, an inappropriate implementation (CWE-841) in PlatformIntegration, incorrect reference resolution (CWE-706) in MediaStream, incorrect authorization (CWE-863) in BrowserTag, and UI misrepresentation issues (CWE-451) affecting FileSystem, the iOS browser UI, and the Android Omnibox. Most of these issues require user interaction, typically visiting a crafted HTML page, and several rely on social engineering to be effective.

Why These Issues Matter

While Chromium rated these issues as Low to Medium severity, several have meaningful real-world impact. The MediaStream and BrowserTag issues (CVE-2026-95275 and CVE-2026-95375) involve bypassing the web origin policy, which is a core security boundary separating websites from each other. The UI spoofing issues (CVE-2026-95363, CVE-2026-95323, CVE-2026-95279) could be used to mislead users about which website or UI element they are interacting with, a common building block for phishing or social engineering attacks. The PlatformIntegration issue on Windows (CVE-2026-95385) involves bypassing system access restrictions, which could have broader implications depending on how the browser interacts with the operating system.

Who Is Affected

All Google Chrome users on Desktop platforms are affected by most of these vulnerabilities. Some issues are platform-specific: CVE-2026-95328 and CVE-2026-95279 affect Chrome on Android specifically, CVE-2026-95323 affects Chrome on iOS, and CVE-2026-95385 affects Chrome on Windows specifically. Organizations and individuals running affected versions of Chrome prior to the fixed release should prioritize updating.

Affected and Fixed Versions

All eight vulnerabilities affect Google Chrome versions prior to 154.0.8037.57. The fix for all eight issues is included in Chrome version 154.0.8037.57, released through the Stable Channel.

Fixes and Mitigation

Google has released Chrome version 154.0.8037.57 via the Stable Channel to address all eight vulnerabilities described in this briefing. Chrome typically updates automatically, but users and administrators should verify their installed version to confirm the update has been applied.

Recommended Action

Verify that Chrome has updated to version 154.0.8037.57 or later on all Desktop, Android, and iOS devices in your environment. Chrome generally updates automatically in the background; a browser restart may be required to complete the update. Administrators managing Chrome deployments via enterprise policy should confirm the update has propagated across managed devices, with particular attention to Windows endpoints given the platform-specific PlatformIntegration issue.