CVE-2026-95376

Analyzed Analyzed - Analysis Complete

Externally controlled reference in Google Chrome DevTools

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: Chrome

Description

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95376

EUVD

EUVD-2026-89257

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-610	The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability involves an issue in Google Chrome's DevTools where an externally controlled reference could be manipulated by an attacker through crafted network traffic. This could allow an adjacent attacker to bypass system access restrictions, potentially leading to unauthorized actions.

Detection Guidance

This vulnerability involves DevTools in Google Chrome being manipulated via crafted network traffic. Detection may require monitoring for unusual Chrome processes or network traffic patterns. Check Chrome version with 'google-chrome --version' and compare against 154.0.8037.57. Inspect network traffic for suspicious activity targeting DevTools.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass security restrictions in Chrome, potentially gaining unauthorized access to sensitive data or performing actions on your system without permission. Users should update Chrome to the latest version to mitigate this risk.

Compliance Impact

This vulnerability involves an attacker bypassing system access restrictions via crafted network traffic in Google Chrome's DevTools. While it does not directly impact GDPR or HIPAA compliance, such vulnerabilities could potentially lead to unauthorized data access or exposure, which may violate these regulations depending on the context of use.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-95376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70