Google Chrome CVE-2026-95380

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build prior to 154.0.8037.57 (Stable channel, September 2026) - the UI:R metric means user interaction (visiting/rendering a malicious page) is mandatory, which limits mass automation compared to a zero-click bug. No authentication or elevated privileges are needed (PR:N), and no non-default configuration is implied. Scope is unchanged (S:U), so the initial code execution is contained within the renderer process sandbox; full host compromise would require chaining an additional sandbox-escape vulnerability. The primary limiting factor beyond patch availability is the need to drive a target to malicious content.

This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a type-confusion flaw (CWE-843) reachable over the network with low complexity and no privileges, requiring only that a victim load attacker-controlled web content (UI:R) - the classic Chrome drive-by profile. The uniform C:H/I:H/A:H impact triad is characteristic of memory-corruption bugs that yield renderer code execution rather than mere data leakage. Signals are largely absent rather than conflicting: no EPSS score, no CISA KEV entry, and no public PoC are provided, so there is no confirmed active exploitation - treat this as 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag conflicts with the vector (I:H and A:H indicate full compromise, not read-only disclosure) and should be discounted; the 'Memory Corruption' tag is consistent with CWE-843. A vendor patch is available (fixed build 154.0.8037.57), which is the decisive risk-reducer. Given Chrome's ubiquity and the historical rate at which type-confusion bugs are weaponized post-disclosure, this warrants prompt patching despite the missing exploitation telemetry.

An attacker hosts or compromises a web page containing JavaScript that triggers the type-confusion condition in the affected Chrome component. A victim running a pre-154.0.8037.57 build simply visits the page (UI:R), causing the renderer to misinterpret an object's type and corrupt memory, giving the attacker a code-execution primitive inside the renderer sandbox. No public PoC is currently identified, and exploitation would typically be chained with a sandbox escape for full host compromise.