CVE-2026-95308

Analyzed Analyzed - Analysis Complete

Integer Overflow in Google Chrome Metrics

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Chrome

Description

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95308

EUVD

EUVD-2026-89151

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the Metrics component of Google Chrome versions before 154.0.8037.57. It allows a remote attacker who has already compromised the renderer process to potentially read memory outside the sandbox by using a specially crafted HTML page.

Detection Guidance

This vulnerability is specific to Google Chrome versions prior to 154.0.8037.57. Detection involves checking the installed Chrome version. On Windows, run: wmic product where "name like 'Google Chrome'" get version. On Linux, run: google-chrome --version or dpkg -l | grep google-chrome. If the version is below 154.0.8037.57, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access memory outside the sandbox, potentially leading to unauthorized data access or further system compromise. However, the attacker must first compromise the renderer process, which limits the attack surface.

Compliance Impact

This vulnerability allows a remote attacker to read memory outside the sandbox via a crafted HTML page, which could potentially expose sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (health information privacy) by increasing the risk of unauthorized data access or disclosure.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the integer overflow vulnerability in Metrics.

Hi! I’m here to help you understand CVE-2026-95308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70