CVE-2026-95385

Analyzed Analyzed - Analysis Complete

PlatformIntegration Inappropriate Implementation in Google Chrome

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: Chrome

Description

Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95385

EUVD

EUVD-2026-89156

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability is an inappropriate implementation in PlatformIntegration in Google Chrome on Windows. It allowed a remote attacker to bypass system access restrictions through social engineering tactics using a crafted HTML page. The severity is rated as Low by Chromium.

Detection Guidance

This vulnerability involves inappropriate implementation in Google Chrome's PlatformIntegration on Windows. Detection primarily requires checking the installed Chrome version. Run 'google-chrome --version' or check 'chrome://settings/help' in the browser to verify if the version is prior to 154.0.8037.57.

Impact Analysis

An attacker could trick you into visiting a malicious webpage, potentially bypassing security restrictions on your system. This might allow unauthorized access or actions, though the severity is low and requires social engineering.

Compliance Impact

This vulnerability involves a bypass of system access restrictions through social engineering, which could potentially lead to unauthorized access to sensitive data. However, the provided context does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability's low severity and lack of detailed exploitation scenarios limit a clear assessment of compliance risks.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-95385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70