CVE-2026-95370

Analyzed Analyzed - Analysis Complete

NFC Inappropriate Implementation in Google Chrome

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: Chrome

Description

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95370

EUVD

EUVD-2026-89118

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability is an inappropriate implementation in the Near Field Communication (NFC) feature of Google Chrome before version 154.0.8037.57. A remote attacker could exploit it by using a specially crafted HTML page to bypass system access restrictions.

Detection Guidance

This vulnerability is specific to Google Chrome prior to version 154.0.8037.57. Detection involves checking the installed Chrome version. On Windows, run: wmic product where "name like 'Google Chrome'" get version. On Linux, run: google-chrome --version. Compare the output against version 154.0.8037.57 or later.

Impact Analysis

An attacker could potentially gain unauthorized access to system features or data by tricking a user into visiting a malicious webpage. This could lead to data theft, unauthorized actions, or further compromise of the user's system.

Compliance Impact

The vulnerability allows a remote attacker to bypass system access restrictions via a crafted HTML page, which could lead to unauthorized data access or modification. This may impact compliance with GDPR by potentially exposing personal data without proper authorization, and with HIPAA by risking unauthorized access to protected health information.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-95370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70