CVE-2026-95280: Google Chrome V8 Race Condition Vulnerability

CVE-2026-95280 Overview

CVE-2026-95280 is a race condition vulnerability in the V8 JavaScript engine used by Google Chrome. Versions prior to 154.0.8037.57 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The Chromium project rated the security severity as High. The flaw is tracked as [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Successful exploitation enables arbitrary code execution inside the renderer sandbox, providing an attacker with a foothold that can be chained with a sandbox escape to achieve full compromise.

Affected Products

Google Chrome Desktop versions prior to 154.0.8037.57
Chromium-based browsers embedding vulnerable V8 builds
Downstream distributions that ship the affected V8 engine

Discovery Timeline

2026-09-29 - CVE-2026-95280 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95280

Vulnerability Analysis

The vulnerability resides in the V8 JavaScript engine, which parses and executes JavaScript and WebAssembly inside every Chrome tab. A race condition allows concurrent operations to reach an inconsistent state that V8's internal invariants assume cannot occur. Once those invariants are violated, an attacker can drive the engine into executing attacker-controlled instructions within the renderer process. Exploitation requires user interaction, such as visiting a page hosting the malicious payload. The high attack complexity reflects the timing precision needed to win the race reliably.

Root Cause

The root cause is improper synchronization between threads or coroutines that share V8 runtime state ([CWE-362]). When two operations access the same resource without adequate locking or ordering guarantees, the engine can observe or mutate objects in an intermediate state. Details are limited pending broader disclosure; refer to Chromium Issue #560406548 for tracking.

Attack Vector

Exploitation is network-based and requires the victim to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers JavaScript that repeatedly triggers the racing code paths until the timing window aligns. Winning the race corrupts internal V8 state, which the attacker leverages to execute arbitrary code within the sandboxed renderer. A separate sandbox escape would be required to reach the host operating system.

No verified proof-of-concept code is publicly available. See the Google Chrome Stable Update advisory for release notes.

Detection Methods for CVE-2026-95280

Indicators of Compromise

Chrome renderer processes crashing with V8 or type-confusion signatures shortly after visiting untrusted pages
Unexpected child processes spawned by chrome.exe following browsing activity
Outbound connections from renderer processes to previously unseen hosts serving HTML or JavaScript payloads

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 154.0.8037.57
Monitor endpoint telemetry for browser process anomalies such as renderer-initiated code execution or memory tampering
Correlate web proxy logs with threat intelligence feeds to identify visits to pages hosting known V8 exploit kits

Monitoring Recommendations

Enable browser crash telemetry and forward it to a centralized analytics platform for triage
Track command-line arguments and parent-child process relationships for chrome.exe and related Chromium binaries
Alert on Chrome renderers writing to disk paths outside their typical profile directories

How to Mitigate CVE-2026-95280

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched V8 binary is loaded
Block access to untrusted or newly registered domains at the web proxy until patch coverage is verified

Patch Information

Google released the fix in the Stable channel update documented at Google Chrome Stable Update. Administrators should push Chrome 154.0.8037.57 or newer via enterprise update policies. Chromium-based browsers should be updated once their vendors incorporate the corresponding V8 fix referenced in Chromium Issue #560406548.

Workarounds

Disable JavaScript for untrusted origins using Chrome enterprise policies where feasible
Enforce Site Isolation and strict sandbox settings to limit renderer compromise impact
Restrict browsing to allowlisted destinations for high-risk user groups until patching completes

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Windows Group Policy registry key to force update channel
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f