CVE-2026-95344: Google Chrome DevTools Race Condition Flaw

CVE-2026-95344 Overview

CVE-2026-95344 is a race condition [CWE-367] in the DevTools component of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.57. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension. The extension exploits the race window to bypass Chrome's site isolation boundary. Google's Chromium team rated the security severity as Medium.

Critical Impact
Successful exploitation lets a malicious extension bypass site isolation, breaking the security boundary that prevents cross-origin data access between web renderers.

Affected Products

Google Chrome for Desktop prior to 154.0.8037.57
Chromium-based browsers incorporating the vulnerable DevTools code
Chrome extension runtime environments on affected builds

Discovery Timeline

2026-09-29 - CVE-2026-95344 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95344

Vulnerability Analysis

The issue is a Time-of-Check to Time-of-Use (TOCTOU) race condition within Chrome DevTools. Site isolation enforces that documents from different sites run in separate renderer processes. DevTools interacts with renderer state through asynchronous messaging and privileged APIs. When two operations race, the state validated at check time can change before it is used.

A crafted extension that has DevTools-related permissions can drive this race deterministically. Winning the race allows the extension to reach content or capabilities in a renderer that site isolation should protect. The result is a cross-origin boundary bypass initiated from the extension context.

Root Cause

The root cause is missing synchronization between the moment DevTools validates the target frame or origin and the moment the associated action executes. Because these steps are not atomic, a concurrent navigation or frame swap can substitute a different origin into the operation. See the Chromium Issue #548611433 tracker for the upstream fix.

Attack Vector

Exploitation requires user interaction. The attacker must convince the target to install a malicious Chrome extension through social engineering, sideloading, or a compromised distribution channel. Once installed, the extension triggers the DevTools code path and races a navigation or frame change to bypass site isolation. No network-adjacent position is required.

No public proof-of-concept exploit is available for CVE-2026-95344. Technical specifics remain restricted pending broader patch adoption, consistent with Chrome's standard disclosure practice.

Detection Methods for CVE-2026-95344

Indicators of Compromise

Chrome browser processes running versions earlier than 154.0.8037.57 after the patch release window.
Newly installed Chrome extensions requesting debugger, devtools, or broad host permissions from untrusted publishers.
Extensions loaded in developer mode or sideloaded outside the Chrome Web Store on managed endpoints.

Detection Strategies

Inventory installed Chrome extensions across the fleet and flag any that request the debugger or devtools_page permissions.
Correlate extension installation events with subsequent unexpected cross-origin network requests from the browser process.
Alert on Chrome version telemetry that remains below 154.0.8037.57 after the vendor patch is available.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to track extension inventory and Chrome version drift.
Monitor extension update manifests and permission changes for behavioral deviations over time.
Track user-reported social engineering attempts that reference browser extension installation prompts.

How to Mitigate CVE-2026-95344

Immediate Actions Required

Update Chrome to version 154.0.8037.57 or later on all managed endpoints.
Restart Chrome after patch installation to ensure the vulnerable renderer and DevTools code paths are unloaded.
Audit installed extensions and remove any that are unnecessary, unsigned, or from unverified developers.

Patch Information

Google addressed the flaw in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm deployment through their update management tooling and verify the running version reports 154.0.8037.57 or newer.

Workarounds

Enforce an enterprise extension allowlist through Chrome policy to block installation of untrusted extensions.
Disable developer mode extension loading on managed browsers to prevent sideloaded payloads.
Deliver targeted user awareness communications warning against installing extensions from unsolicited links or prompts.

bash

# Chrome enterprise policy example: restrict extensions to an allowlist
# Linux: /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}