Google Chrome Patches Eight UI Spoofing and Authorization Flaws (154.0.8037.57)

What happened

Google published a Stable Channel Update for Chrome Desktop disclosing eight vulnerabilities, all rated Chromium security severity Medium or Low, and all fixed in version 154.0.8037.57. The group includes UI misrepresentation issues (CWE-451) that could allow a remote attacker to spoof UI elements or the address bar via a crafted HTML page (CVE-2026-95321, CVE-2026-95307, CVE-2026-95337, CVE-2026-95291, CVE-2026-95288), missing authorization issues (CWE-862) that could allow an attacker who had already compromised the renderer process to spoof the address bar or UI elements (CVE-2026-95320, CVE-2026-95371), and an inappropriate implementation issue in NFC handling (CWE-841) that could allow a remote attacker to bypass system access restrictions via a crafted HTML page (CVE-2026-95370).

Technical cause

The vulnerabilities fall into three categories. Five are UI misrepresentation flaws (CWE-451) affecting components such as Payments, ExtensionsMenu, Messages, SecurityIndicators, and Mobile, where a crafted HTML page could cause Chrome to display misleading or spoofed UI, including the address bar in some cases. Two are missing authorization flaws (CWE-862) in the Navigation and Views components, which required an attacker to have already compromised the renderer process before the spoofing could occur. One is an inappropriate implementation flaw (CWE-841) in NFC handling that could let an attacker bypass system access restrictions via a crafted HTML page. All eight share the same CVSS base score of 5.4, with most requiring some form of user interaction and, for several, social engineering.

Why it matters

UI spoofing vulnerabilities, particularly those affecting the address bar or security indicators, can be used to deceive users about the true origin or trustworthiness of a page, which can facilitate phishing or social-engineering attacks. The two missing-authorization issues require prior compromise of the renderer process, meaning they would likely be chained with another vulnerability rather than exploited in isolation. The NFC-related issue could allow bypass of system access restrictions on supported platforms. None of these issues allow memory corruption or direct code execution on their own, based on the information provided.

Who is affected

Users and organizations running Google Chrome prior to version 154.0.8037.57 are affected. Specific issues apply to particular platforms: CVE-2026-95321 and CVE-2026-95337 affect Chrome on Android; CVE-2026-95291 and CVE-2026-95288 affect Chrome on iOS; CVE-2026-95371 affects Chrome on Mac; CVE-2026-95307, CVE-2026-95320, and CVE-2026-95370 are described generally for Google Chrome without a specific platform designation in the provided descriptions.

Discovery and timeline

All eight vulnerabilities were disclosed on September 22, 2026 via Google's Chrome Stable Channel Update blog post, with corresponding NVD entries published on September 29, 2026. The fact package does not identify a discoverer for any of these issues, and no claims of active exploitation or public proof-of-concept exploits are included in the available information.

Affected versions

All eight vulnerabilities affect Google Chrome versions prior to 154.0.8037.57. No lower bound of the affected version range is specified in the available data.

Fixes and mitigation

Google has released version 154.0.8037.57, which resolves all eight vulnerabilities described in this briefing. No workarounds or mitigations other than updating are mentioned in the source material.

Recommended action

Update Google Chrome to version 154.0.8037.57 or later on all affected platforms (Desktop, Android, iOS, and Mac as applicable) as soon as possible. Chrome typically updates automatically, but users and administrators should verify the installed version via the browser's About page and restart the browser to complete the update.