Google Chrome CVE-2026-95351

Exploitation requires a victim using a Google Chrome desktop build older than 154.0.8037.57 to load attacker-controlled web content and perform some interaction (UI:R) with it. The use-after-free is reachable remotely without authentication (PR:N) but is rated AC:H, meaning success depends on winning a race or achieving reliable heap layout/grooming rather than a single deterministic trigger. Limiting factors: the browser must be unpatched, user interaction is needed (so no zero-click drive-by), and the exact triggering component/feature is not disclosed in the available data. No default-configuration server exposure exists - this is a client-side browser flaw.

This is a genuinely high-priority browser vulnerability, though its real-world exploitability is tempered by attack complexity. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) describes an unauthenticated, network-reachable use-after-free that crosses a security boundary (S:C, consistent with a renderer-to-broader-context compromise) with full CIA impact - i.e. RCE-class. However, AC:H signals that reliable exploitation requires specific conditions (heap grooming, timing/race window) rather than trivial triggering, and UI:R means a victim must visit or interact with attacker content. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Note a signal conflict: the tag set includes 'Information Disclosure,' but the vector shows I:H/A:H - this is a memory-corruption/RCE-class bug, not a mere info leak, so the label understates the impact. The absence of EPSS/KEV data is not itself reassuring for a browser flaw: Chrome memory-corruption bugs are historically favored targets, and a patch already shipping (154.0.8037.57) makes n-day exploitation of unpatched clients the dominant risk. Treat as high priority for patch rollout despite AC:H.

An attacker hosts a malicious web page (or malvertising/compromised site) that drives a Chrome component into a use-after-free condition; a victim running a pre-154.0.8037.57 build visits the page and interacts as required (UI:R). With successful heap grooming, the freed-object reuse yields memory corruption that can lead to code execution and, given S:C, escape of the immediate context. No public POC was identified at time of analysis, and AC:H means the exploit is not point-and-click reliable.