CVE-2026-95360: Google Chrome Race Condition Vulnerability

CVE-2026-95360 Overview

CVE-2026-95360 is a race condition vulnerability in the Editing component of Google Chrome versions prior to 154.0.8037.57. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page. Successful exploitation allows the attacker to obtain sensitive information from the browser. Chromium security engineers rated the flaw Medium severity. The vulnerability is tracked under [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition].

Critical Impact
Attackers can extract sensitive in-browser information by winning a timing window in Chrome's Editing subsystem, though exploitation requires user interaction with a crafted page.

Affected Products

Google Chrome Desktop versions prior to 154.0.8037.57
Chromium-based browsers incorporating the vulnerable Editing component
All supported desktop platforms (Windows, macOS, Linux) running unpatched Chrome builds

Discovery Timeline

2026-09-29 - CVE-2026-95360 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95360

Vulnerability Analysis

The flaw resides in Chrome's Editing component, which handles user text input, selection, clipboard operations, and DOM mutations tied to contenteditable regions. A race condition allows concurrent operations to observe inconsistent state between validation and use. An attacker who wins the timing window can read data that should remain isolated from the origin serving the crafted page.

Because exploitation requires user interaction and depends on winning a narrow scheduling window, attack complexity is elevated. The confidentiality impact is significant while integrity and availability are unaffected, which aligns with an information disclosure primitive rather than code execution.

Root Cause

The root cause is a Time-of-check Time-of-use (TOCTOU) condition in the Editing subsystem. Editing operations validate object state, then reuse that state after asynchronous tasks may have mutated it. An attacker crafts DOM events that interleave with editing callbacks to force the browser to act on stale references or expose buffers that have not been sanitized for the current execution context.

Attack Vector

The attack begins when a user is lured to a malicious page through phishing, malvertising, or a compromised site. The page executes JavaScript that rapidly triggers editing operations, selection changes, or clipboard interactions to induce the race. When the race is won, the attacker script reads sensitive content that would otherwise be inaccessible.

No authentication is required. Network-based delivery is sufficient, and the payload is entirely client-side.

No verified proof-of-concept code is publicly available. Technical details are tracked in the Chromium Issue Tracker Entry and referenced in the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-95360

Indicators of Compromise

Browser process telemetry showing Chrome versions below 154.0.8037.57 after the patch release date
Outbound HTTPS requests to newly registered or low-reputation domains immediately following user interaction with an email or messaging link
Web content containing high-frequency DOM mutations tied to contenteditable elements and rapid selection changes

Detection Strategies

Inventory browser versions across managed endpoints and flag installations below 154.0.8037.57
Correlate web proxy logs with phishing indicators to identify users who visited suspicious pages capable of hosting exploit content
Monitor for anomalous clipboard-read or selection-related API activity where browser extension telemetry is available

Monitoring Recommendations

Ingest browser update state and version data into the SIEM for continuous compliance reporting
Alert on Chrome patch-level drift beyond the vendor's stable channel release window
Track social engineering campaigns targeting employees and correlate against browser version posture

How to Mitigate CVE-2026-95360

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into active browser processes
Reinforce phishing awareness training, since exploitation requires user interaction with a crafted page

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Stable Update advisory. Administrators managing Chromium-based browsers should confirm that downstream vendors have merged the upstream fix from the Chromium Issue Tracker Entry.

Workarounds

Enforce enterprise policies that block execution of JavaScript on untrusted domains through URL allowlisting
Deploy web content filtering to reduce exposure to phishing and malvertising infrastructure
Restrict browser extensions that expand DOM automation surface until endpoints are patched

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force update via Chrome policy (Windows registry example)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f