Google Chrome CVE-2026-95362

Requires user interaction: a Chrome desktop user running a version earlier than 154.0.8037.57 must visit or interact with an attacker-controlled/malicious web page (UI:R). No authentication or elevated privileges are needed (PR:N), and no special or non-default Chrome configuration is indicated. Exploitation is limited by the need to drive a victim to the malicious content and by the availability of the vendor patch (154.0.8037.57 and later are not affected). The precise triggering feature cannot be pinned down because the CVE description is absent and the CWE-352 label appears inconsistent with the stated impact.

Signals are mixed and partly thin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (a victim visiting a malicious page) and yields full compromise of the browser's confidentiality, integrity, and availability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation - this is 'no public exploit identified at time of analysis.' The 8.8 rating is therefore driven by the technical impact and browser attack surface, not by observed exploitation. One genuine anomaly must be stated explicitly: the CWE is CWE-352 (Cross-Site Request Forgery), yet CSRF alone almost never produces C:H/I:H/A:H on the browser itself - this combination suggests either a mislabeled root cause or a web-platform/security-UI bug that Google's tracker grouped under CSRF; verify the true class against the Chromium issue (511791538) before treating it as classic CSRF. Also note the entire description is absent, so impact wording is inferred purely from the CVSS vector. Net: a real patch-now priority because of Chrome's ubiquity and the high impact, but not an emergency in the absence of exploitation signals.

An attacker hosts or injects a malicious web page and lures a Chrome desktop user (before 154.0.8037.57) to visit it. When the page loads, it triggers the flaw - nominally a cross-site request forgery / cross-origin state-change condition - resulting in compromise of browser-held data and process integrity without any credentials on the attacker's part. No public proof-of-concept was identified at the time of analysis.