CVE-2026-95384

Analyzed Analyzed - Analysis Complete

Race Condition in Google Chrome Transactions Platform

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: Chrome

Description

Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95384

EUVD

EUVD-2026-89129

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in Google Chrome's Transactions Platform. A race condition occurs when the system's behavior depends on the timing of events, which can lead to unexpected outcomes. In this case, an attacker could exploit this flaw by crafting a malicious HTML page to potentially access or leak sensitive information during these timing discrepancies.

Detection Guidance

This vulnerability is specific to Google Chrome and requires detecting outdated versions. Check Chrome version via chrome://version/ or command line (e.g., 'google-chrome --version'). Compare against version 154.0.8037.57 or later. Network detection may involve monitoring for unusual HTML page interactions or transaction patterns.

Impact Analysis

If exploited, this vulnerability could allow a remote attacker to access sensitive information from your browser session. This might include personal data, login credentials, or other confidential details stored or processed by Chrome. Users could be affected if they visit a specially crafted malicious webpage.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, which may violate compliance requirements under GDPR or HIPAA. Organizations handling such data must ensure timely patching to mitigate risks of data breaches and regulatory penalties.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the race condition vulnerability.

Hi! I’m here to help you understand CVE-2026-95384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70