Google Chrome Stable Update Fixes Seven Vulnerabilities, Including High-Severity V8 and Aura Flaws

What happened

Google released a Stable Channel update for Chrome on Desktop that resolves seven separate vulnerabilities. These affect the following components: V8 (CVE-2026-95280), Aura (CVE-2026-95315), DevTools (CVE-2026-95344 and CVE-2026-95376), Bluetooth (CVE-2026-95326), WebView on Android (CVE-2026-95285), and WakeLock (CVE-2026-95278). The vulnerabilities include race conditions, a use-after-free, missing authorization checks, an externally controlled reference, and incomplete cleanup.

Technical causes

The root causes vary by component. CVE-2026-95280 (V8) and CVE-2026-95344 (DevTools) are race conditions (CWE-367/CWE-362) that can allow sandbox code execution or site isolation bypass respectively. CVE-2026-95315 (Aura) is a use-after-free (CWE-416) that could allow code execution outside the sandbox following local UI interaction. CVE-2026-95285 (WebView) and CVE-2026-95278 (WakeLock) are missing authorization issues (CWE-862) that could allow a compromised renderer process to bypass web origin policy or system access restrictions. CVE-2026-95326 (Bluetooth) stems from incomplete cleanup (CWE-459), and CVE-2026-95376 (DevTools) involves an externally controlled reference (CWE-610) that could be abused via crafted network traffic by an adjacent attacker using social engineering.

Why it matters

Two of the seven vulnerabilities (CVE-2026-95280 in V8 and CVE-2026-95315 in Aura) are rated 'High' by Chromium's own severity scale, indicating a greater potential impact if exploited, including arbitrary code execution inside or outside the browser sandbox. The remaining five are rated Medium or Low by Chromium, though CVSS base scores for several of these reach 8.0 or higher, reflecting a high impact on confidentiality, integrity, or availability under certain conditions. None of the seven vulnerabilities are listed as known to be exploited, and no public exploit code has been reported.

Who is affected

All users running Google Chrome on Desktop prior to version 154.0.8037.57 are affected. One vulnerability, CVE-2026-95285, specifically concerns Chrome's WebView component on Android.

Affected and fixed versions

All versions of Google Chrome prior to 154.0.8037.57 are affected by these vulnerabilities. The fact package does not specify a precise lower bound for each affected range, so users should treat any version older than the fixed release as vulnerable.

Fixes and mitigation

Google has released Chrome 154.0.8037.57 for Desktop, which resolves all seven vulnerabilities described in this briefing. Chrome typically updates automatically on restart; users can also trigger an update manually via the browser's settings menu.

Recommended action

Update Google Chrome to version 154.0.8037.57 or later as soon as possible. Restart the browser after the update is applied to ensure the fix takes effect. Organizations managing Chrome deployments via enterprise policy should verify that the update has been pushed to all managed endpoints, including any Android devices relying on Chrome's WebView component.