CVE-2026-95357

Summary

The flaw is an out-of-bounds write vulnerability in the GPU component of Google Chrome on Android, allowing remote attackers to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability is critical due to its ability to bypass security restrictions and gain full control over the device.

Exploitability

Exploitation is considered highly feasible as it requires a crafted HTML page, which can be delivered through various vectors such as phishing or malicious websites. The attacker must have the ability to deliver the crafted content to the victim.

Blast radius

If exploited, the impact could be severe, as it allows the execution of arbitrary code outside the sandbox, potentially leading to full device compromise and loss of user data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome version 154.0.8037.57 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.