CVE-2026-95350: Google Chrome Buffer Overflow Vulnerability

CVE-2026-95350 Overview

CVE-2026-95350 is a heap buffer overflow [CWE-122] in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Android. Versions prior to 154.0.8037.57 are affected. A remote attacker can execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page to a victim. Google classified the Chromium security severity as Critical. Exploitation requires user interaction, specifically loading the malicious page in the browser. Because ANGLE brokers WebGL and graphics API calls between the renderer and the underlying GPU driver, successful exploitation can escape the renderer sandbox and gain code execution in a more privileged process context.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox on Android devices via a single crafted web page.

Affected Products

Google Chrome for Android prior to 154.0.8037.57
Google Android platforms running vulnerable Chrome builds
Chromium-derived browsers using the same ANGLE version on Android

Discovery Timeline

2026-09-29 - CVE-2026-95350 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95350

Vulnerability Analysis

The flaw resides in ANGLE, the translation layer that converts OpenGL ES API calls from Chrome content processes into native GPU driver calls on the host operating system. On Android, ANGLE handles WebGL, WebGPU, and canvas rendering paths. A heap buffer overflow in this component allows attacker-controlled data to be written beyond an allocated buffer on the heap. Because ANGLE code runs in the GPU process, which sits outside the renderer sandbox, memory corruption here provides a direct path to sandbox escape. The vendor advisory confirms arbitrary code execution outside the sandbox as the resulting impact.

Root Cause

The root cause is a heap-based buffer overflow classified under [CWE-122]. This class of defect typically arises from missing or incorrect bounds checking during graphics resource processing, shader compilation, or vertex and texture data handling. Google has not published the specific vulnerable function pending broader patch deployment across the Chrome ecosystem.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that issues specific WebGL or graphics API sequences designed to trigger the overflow. When a victim visits the page in a vulnerable Chrome for Android build, the malicious payload corrupts heap memory in the GPU process. Successful exploitation yields code execution outside the renderer sandbox, bypassing a primary Chromium defense boundary. No authentication is required, and the attack scales across any Android user who can be lured to attacker-controlled content, including via malvertising, phishing links, or compromised sites.

No public proof-of-concept code has been released. Refer to the Chromium Issue Tracker entry for technical details as they become public.

Detection Methods for CVE-2026-95350

Indicators of Compromise

Unexpected Chrome GPU process crashes or restart loops on Android devices, particularly correlated with visits to unfamiliar sites
Outbound connections from mobile endpoints to newly registered domains hosting WebGL-heavy or graphics-intensive HTML content
Post-exploitation artifacts such as unexpected child processes, new persistence entries, or credential access attempts following browser sessions

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag any build below 154.0.8037.57
Correlate mobile browser telemetry with threat intelligence feeds tracking Chrome exploit kits and malicious ad networks
Monitor network egress for known malicious infrastructure delivering crafted HTML payloads targeting ANGLE

Monitoring Recommendations

Enable mobile threat defense telemetry to capture Chrome crash reports and abnormal GPU process behavior
Ingest browser version data from mobile device management (MDM) platforms into your SIEM for continuous compliance checks
Alert on repeated GPU process termination events on the same device within short time windows

How to Mitigate CVE-2026-95350

Immediate Actions Required

Update Google Chrome for Android to version 154.0.8037.57 or later through the Google Play Store
Push forced updates via enterprise mobility management for managed Android devices
Verify Chromium-derived browsers on Android have merged the corresponding upstream fix before permitting continued use

Patch Information

Google addressed the vulnerability in the Stable channel update documented in the Google Chrome Desktop Update announcement. Android users receive the fix by upgrading Chrome to 154.0.8037.57 or later. Additional technical context is tracked in the Chromium Issue Tracker entry.

Workarounds

Restrict browsing to trusted sites until patched builds are confirmed installed across the fleet
Disable hardware-accelerated WebGL where feasible on high-risk devices, understanding this degrades web application functionality
Use enterprise browser policies to block untrusted content categories on managed Android endpoints

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for a patched device:
# versionName=154.0.8037.57