Google Chrome CVE-2026-95284

Exploitation requires the victim to run an unpatched Chrome build earlier than 154.0.8037.57 and to load attacker-controlled web content (UI:R) - e.g., visiting a malicious site, compromised page, or malicious ad - which triggers the heap buffer overflow. No authentication or elevated privileges are needed on the target (PR:N), and the attack is remote over the network (AV:N/AC:L). Limiting factors: the required user interaction (page load), Chrome's silent auto-update which rapidly shrinks the vulnerable population, and the likelihood that full host compromise requires chaining the renderer-process overflow with a separate sandbox-escape bug rather than this flaw alone.

Signals conflict in the usual browser-bug pattern: the CVSS base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by a scope-changing heap buffer overflow (CWE-122) reachable from the network with low complexity and no privileges, but EPSS exploitation probability is only 0.29% (19th percentile), there is no CISA KEV listing, and no public exploit is identified at time of analysis. The high CVSS is amplified by the S:C/C:H/I:H/A:H assumption that the memory-corruption primitive leads to a full sandbox escape and arbitrary code execution; in practice a renderer-process heap overflow typically yields code execution only within the sandboxed content process unless chained with a separate escape, so real-world impact may be lower than 9.6 suggests. The mitigating UI:R requirement (the victim must load attacker-controlled content) plus Google's rapid auto-update channel further reduce widespread risk. Net assessment: important to patch given Chrome's ubiquity and the memory-corruption class, but the absence of KEV/POC and the low EPSS indicate this is not currently under active or broad exploitation - prioritize via normal Chrome update cadence rather than emergency response. Note the metadata gap: the description is '[Unknown description]', so the exact vulnerable component and whether impact is renderer-only versus privileged is not confirmed from the provided data.

An attacker hosts a malicious web page (or malvertising/compromised site) crafted to trigger the heap buffer overflow in a vulnerable Chrome build prior to 154.0.8037.57. A victim running an unpatched Chrome visits the page, the overflow corrupts heap memory, and the attacker attempts code execution in the content process, potentially chaining to a sandbox escape. No public exploit is identified at time of analysis, and user interaction (visiting the page) is required.