Threat level Severe
Contact
Critical 9.6
CVE-2026-95313

Google Chrome — remote code execution.

Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.6
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.5%
Higher than 39% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

What to do

  1. 01Check whether you run Google Chrome, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
Google108 CVEs in 30 days
All Google CVEs

Other CVEs in Google Chrome

40+ more CVEs

All Google Chrome CVEs
9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.