Google Chrome CVE-2026-95372

Exploitation requires the victim to actively load attacker-controlled web content in a vulnerable Chrome desktop build (UI:R - the user must visit a malicious or compromised page); no prior authentication is needed (PR:N). The primary limiting factor is the AC:H rating, indicating a timing/race or specific heap-state precondition must be satisfied for the use-after-free to become reliably exploitable, which raises the bar above trivial. A patched Chrome version (September 2026 stable channel update) is available and neutralizes the flaw. The exact triggering feature is not specified in the available description.

This is a genuinely high-severity issue that warrants prompt patching. The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, unauthenticated use-after-free (CWE-416) in Google Chrome that requires user interaction (visiting a malicious page) and carries a scope change (S:C), consistent with a renderer-to-broader-context memory-corruption primitive. The AC:H is notable: unlike several sibling Chrome UAFs in the same September 2026 stable batch which were rated AC:L, this one is rated AC:H, implying exploitation depends on winning a race or achieving a specific heap/timing state - a real but surmountable barrier for skilled exploit developers. Signals are incomplete: EPSS is not provided, this CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation at time of analysis. The counterweight is prevalence - Chrome is ubiquitous and browser UAFs are historically among the most reliably weaponized bug classes, so treat the low-observed-exploitation signal as 'not yet' rather than 'low risk.' Note the input tag 'Information Disclosure' understates impact: with I:H and A:H this is memory corruption with code-execution potential, not a mere read primitive.

An attacker hosts a malicious web page (or compromises an ad/iframe on a legitimate site) and lures a victim into visiting it with an unpatched Chrome build. The page triggers the use-after-free condition, and given the AC:H rating, reliably grooming the heap to win the race yields a controllable dangling pointer usable for memory corruption and likely renderer compromise. No public exploit code is referenced at time of analysis.