Google Chrome Stable Update Fixes Seven High-Severity Memory Safety Vulnerabilities

Seven vulnerabilities patched in one Stable release

Google's Chrome Releases blog announced a Stable Channel update bringing Chrome Desktop to version 154.0.8037.57. The update bundles fixes for seven distinct CVEs: CVE-2026-95286 (type confusion in Bindings), CVE-2026-95373 (use-after-free in DevTools), CVE-2026-95338 (use-after-free in PDFium), CVE-2026-95304 (out-of-bounds write in V8), CVE-2026-95343 (use-after-free in WebAudio), CVE-2026-95353 (use-after-free in Bindings), and CVE-2026-95365 (type confusion in IndexedDB). Each affects Chrome prior to 154.0.8037.57.

Memory-safety bugs across multiple components

All seven issues stem from classic memory-safety weaknesses. CVE-2026-95286 and CVE-2026-95365 are type confusion flaws (CWE-843) in the Bindings and IndexedDB components, respectively. CVE-2026-95373, CVE-2026-95338, CVE-2026-95343, and CVE-2026-95353 are use-after-free flaws (CWE-416) in DevTools, PDFium, WebAudio, and Bindings. CVE-2026-95304 is an out-of-bounds write (CWE-787) in V8, Chrome's JavaScript engine. Six of the seven are triggered via a crafted HTML page; CVE-2026-95338 is triggered via a crafted PDF file processed by PDFium.

Potential for sandboxed code execution

Each vulnerability carries a CVSS score of 8.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network-exploitable, low-complexity attacks that require no privileges but do require user interaction (such as visiting a malicious page or opening a crafted PDF). Successful exploitation could let an attacker execute arbitrary code inside Chrome's sandbox, impacting confidentiality, integrity, and availability. Chromium's own severity ratings label six of the issues High and one (CVE-2026-95353) Medium, though the CVSS score reported for all seven in this package is identical. The description for CVE-2026-95365 notes exploitation would only 'potentially' allow code execution, and CVE-2026-95373 notes the attack requires social engineering.

Chrome Desktop users

Any user running Google Chrome on desktop prior to version 154.0.8037.57 is affected by these issues. No other products are named in this fact package.

Update to Chrome 154.0.8037.57

Google has fixed all seven vulnerabilities in Chrome 154.0.8037.57 for Desktop. No alternative mitigations or workarounds were provided in the vendor announcement.

Update now

Site owners and users should ensure Chrome updates to version 154.0.8037.57 or later, either automatically or by manually checking for updates via Chrome's settings menu. Because sandbox-escape-adjacent code execution bugs are involved, prompt patching is advised, particularly for environments where users routinely open untrusted web pages or PDF files.