CVE-2026-95357 in Chrome
Summary
by MITRE • 09/29/2026
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability described involves an out-of-bounds write condition within the graphics processing unit subsystem of Google Chrome on Android, specifically in versions prior to 154.0.8037.57. This type of memory corruption error typically arises when a program writes data beyond the boundaries of allocated memory buffers without proper bounds checking. In the context of browser-based rendering engines such as Chromium's GPU process, this flaw can be triggered by maliciously crafted HTML pages that exploit specific graphics API calls or shader programs. The severity is classified as critical because it allows for potential arbitrary code execution outside the security sandbox that normally isolates web content from the underlying operating system and user data.
From a technical perspective, out-of-bounds writes are particularly dangerous in GPU contexts due to how memory management operates within these specialized processors. When an attacker crafts input that causes the browser to write data past the end of a buffer, it can overwrite adjacent memory structures. If this overflow affects control flow data or function pointers stored in nearby memory regions, it may allow the attacker to redirect execution to malicious shellcode injected into the process memory space. This bypasses standard sandboxing mechanisms because the exploit leverages native code execution paths within the GPU driver or browser renderer processes that have higher privileges than typical web content contexts.
The operational impact of this vulnerability is severe for users relying on Google Chrome as their primary browsing tool on Android devices. Successful exploitation could lead to full device compromise, allowing attackers to install malware, exfiltrate sensitive information such as credentials and personal data, or establish persistent access to the system. Since the attack vector involves a crafted HTML page, it can be delivered via phishing campaigns, drive-by downloads from compromised websites, or malicious advertisements embedded in legitimate sites. This makes remote exploitation feasible without any user interaction beyond visiting the targeted webpage.
Industry standards classify this type of vulnerability under CWE-787: Out-of-bounds Write, which highlights the failure to verify array bounds before writing data to memory. In terms of attack tactics and techniques, this aligns with MITRE ATT&CK technique T1203: Exploitation for Client Execution, where adversaries leverage software vulnerabilities in client applications to execute malicious code on a victim's device. The exploitation path often involves privilege escalation from the sandboxed renderer process to the browser’s main process or system level, corresponding to techniques such as T1055: Process Injection or T1068: Exploitation for Privilege Escalation depending on the specific memory corruption mechanics and subsequent steps taken by the exploit chain.
Mitigation strategies primarily involve applying the latest security patches provided by Google in version 154.0.8037.57 or later, which address the underlying memory management flaws within the GPU subsystem. Users should ensure automatic updates are enabled to receive these fixes promptly as they become available. Additionally, enabling sandboxing features and keeping browser settings configured for maximum security can reduce the attack surface. For enterprise environments, deploying content policies that restrict execution of untrusted scripts or limiting access to certain web APIs may provide additional layers of defense against similar exploitation attempts until all client devices are updated.