Google Chrome Patches Two Medium-Severity Vulnerabilities (CVE-2026-95287, CVE-2026-95309)

What happened

Google published a Stable Channel update for Chrome on desktop fixing two vulnerabilities. CVE-2026-95287 is a missing authorization issue in Chrome's Navigation component that could allow an attacker who has already compromised the renderer process to bypass site isolation using a crafted HTML page. CVE-2026-95309 is a UI misrepresentation issue in Chrome's Mobile component on iOS, which could allow a remote attacker to spoof UI elements via a crafted HTML page.

Technical cause

CVE-2026-95287 is classified under CWE-862 (Missing Authorization) and arises in the Navigation component; it requires that an attacker has already compromised the renderer process as a precondition before the site isolation bypass can occur. CVE-2026-95309 is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information) and affects the Mobile component specifically on iOS, where a crafted HTML page can cause spoofing of UI elements.

Why it matters

Site isolation is a core security boundary in Chrome designed to prevent one website from accessing data belonging to another. A bypass, even one requiring a compromised renderer as a precondition, weakens this defense-in-depth mechanism. The UI spoofing issue on iOS could be used to mislead users about the content or origin of a page, which may facilitate phishing or other deceptive attacks. Chromium rated the first issue as Medium severity and the second as Low severity.

Who is affected

CVE-2026-95287 affects Google Chrome on desktop platforms prior to version 154.0.8037.57. CVE-2026-95309 affects Google Chrome on iOS prior to the same version.

Affected versions

Both vulnerabilities affect Google Chrome versions prior to 154.0.8037.57. The fact package does not specify a lower bound for the affected range, so the full extent of affected prior versions is not detailed in the available sources.

Fixes and mitigation

Google has fixed both vulnerabilities in Chrome version 154.0.8037.57, released via the Stable Channel update for desktop. Users and administrators should ensure Chrome is updated to this version or later.

Recommended action

Update Google Chrome to version 154.0.8037.57 or later as soon as possible. Chrome typically updates automatically, but users and administrators managing fleets should verify the installed version and force an update check if necessary, particularly for iOS deployments affected by CVE-2026-95309.