Google Chrome CVE-2026-95376

Exploitation requires the attacker to hold an adjacent network position (CVSS AV:A - same local/L2 network segment such as a shared LAN or Wi-Fi, not arbitrary internet reach) AND the victim to be running a Google Chrome desktop build earlier than 154.0.8037.57. User interaction is required (UI:R): the victim must load or navigate to attacker-influenced content. No authentication or elevated privileges are needed (PR:N). Limiting factors: the adjacent-only vector and the mandatory user interaction substantially constrain mass or remote exploitation; an official fix is already shipped in the stable channel, so exposure is limited to unpatched clients. The exact triggering feature could not be named because the CVE description was not provided.

Risk is driven primarily by prevalence rather than exploitation signals. The affected product is Google Chrome desktop (fixed in 154.0.8037.57), one of the most widely deployed applications in existence, so the potential exposure is enormous. However, the exploitation-likelihood signals are quiet: there is no CISA KEV listing, no EPSS score provided, and no public POC identified in the input. The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.0) contains a notable anomaly - AV:A (Adjacent) rather than the AV:N typical of browser rendering bugs. This implies the attacker must occupy the same local/adjacent network segment (same L2 broadcast domain, shared Wi-Fi/LAN) rather than exploit arbitrarily from the internet, which materially narrows the realistic attacker population despite the high base score. The CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) classification is consistent with a cross-sphere reference leaking or corrupting data, but the 'Information Disclosure' tag conflicts with the vector's C:H/I:H/A:H, which claims full confidentiality, integrity AND availability impact - the tag understates the flaw. The underlying CVE description was not available ('[Unknown description]'), so the exact mechanism cannot be confirmed. Net: a high-CVSS bug in a ubiquitous product, but with adjacent-only reach, required user interaction, an available patch, and no evidence of active or imminent exploitation - a patch-on-normal-cadence priority, not an emergency, absent new exploitation intelligence.

An attacker on the same local network (e.g., shared corporate LAN or public Wi-Fi) lures a victim running a pre-154.0.8037.57 Chrome build into visiting or loading attacker-influenced content that triggers an externally controlled reference to a resource in another sphere. The user interaction requirement (UI:R) means the victim must open a page or perform a navigation. No public exploit code was identified at time of analysis.