Google Chrome CVE-2026-95280

Exploitation requires the victim to visit or load attacker-controlled web content in a vulnerable Chrome build (any version below 154.0.8037.57 on the affected stable channel); this is the UI:R requirement and is the primary limiting factor. No authentication or privileges are needed (PR:N), and no special non-default browser configuration is indicated. Because this is a race condition (CWE-362), reliable exploitation may require winning a timing window, which can reduce real-world reliability despite the AC:L rating. Impact is contained to the renderer process (S:U), so a separate sandbox escape would be needed for full host compromise.

This is a genuine high-priority issue by product footprint rather than by exploitation signal. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a page), with high confidentiality, integrity, and availability impact contained to the renderer (S:U) - the classic drive-by, RCE-class profile for a browser memory-safety bug. The CWE-362 race condition classification is consistent with a scope-unchanged renderer compromise. However, exploitation signals are weak/absent: no EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag conflicts with the vector, which shows I:H and A:H - this is a full memory-corruption/RCE-class bug, not a mere info-leak, so the tag understates impact. A patch is available from the vendor (Chrome stable channel update, fixed at 154.0.8037.57). Net: prioritize patching due to ubiquitous deployment and drive-by reachability, but there is no evidence of active or automated exploitation at this time.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that triggers the race condition in Chrome's renderer when the victim navigates to it. Winning the race corrupts memory to achieve code execution within the sandboxed renderer process (S:U). No public proof-of-concept is identified in the available data, and exploitation requires the victim to load attacker-controlled content (UI:R).