Google Chrome CVE-2026-95365

Exploitation requires the victim to actively load attacker-controlled web content in a vulnerable Chrome build prior to 154.0.8037.57 (UI:R - the user must visit/render the malicious page). No authentication or prior privileges are needed (PR:N), and the attack is network-delivered (AV:N) with low complexity (AC:L). The main limiting factors are the user-interaction requirement and that the impact is renderer-scoped (S:U), meaning a full system compromise would additionally need a sandbox escape not described here. Applies to default Chrome configurations - no non-default feature or setting is indicated.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - network-reachable, low attack complexity, no privileges, but requiring user interaction (visiting a malicious page). The CWE-843 type-confusion class in a renderer typically yields a memory-corruption primitive that maps to full C:H/I:H/A:H, consistent with a drive-by RCE-class flaw contained within the renderer sandbox (S:U, no scope change). No EPSS score is provided, there is no CISA KEV listing, and no public POC is identified, so all quantitative exploitation-probability signals are absent. This means the risk profile rests almost entirely on the CVSS vector and product ubiquity rather than confirmed exploitation. Weigh it as a genuine HIGH priority for patching because Chrome is ubiquitous and browser type-confusion bugs are a historically favored exploitation target, but note there is no evidence of active or automated exploitation at this time - treat it as high-value-to-patch rather than under-active-attack. Note also a conflict in the input Tags: it is labeled 'Information Disclosure', which contradicts the I:H/A:H integrity and availability impacts in the vendor CVSS vector; the memory-corruption RCE class is not a pure disclosure issue.

An attacker hosts or compromises a web page containing crafted JavaScript/content that triggers the type confusion in a vulnerable Chrome renderer when the victim visits it. The confusion lets the attacker manipulate an object as an incompatible type, corrupting memory to gain arbitrary read/write and ultimately code execution within the renderer process. No public exploit code has been identified, and success requires the victim to load the malicious page (UI:R).