CVE-2026-95362: Google Chrome DevTools CSRF Vulnerability

CVE-2026-95362 Overview

CVE-2026-95362 is a Cross-Site Request Forgery (CSRF) vulnerability in the DevTools component of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.57 and allows a remote attacker leveraging social engineering to bypass web origin policy through a crafted HTML page. Chromium assigned the issue a security severity of Medium. The weakness is classified as CWE-352: Cross-Site Request Forgery.

Critical Impact
A crafted HTML page can trick a user into triggering DevTools actions that bypass web origin protections, exposing browser state or data across origin boundaries.

Affected Products

Google Chrome versions prior to 154.0.8037.57
Chromium-based browsers incorporating the affected DevTools component
Desktop Chrome Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-29 - CVE-2026-95362 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95362

Vulnerability Analysis

The vulnerability resides in Chrome DevTools, the built-in developer tooling exposed by the browser. DevTools operates with elevated privileges relative to standard web content, including access to internal browser state and cross-origin resources. A CSRF condition in this component permits a malicious page to induce DevTools into performing actions on behalf of the user without proper origin validation.

An attacker must persuade the victim to open or interact with a crafted HTML page. Once triggered, the flaw allows the attacker to bypass the same-origin policy enforced across web content. This can enable unauthorized reads or state changes that would otherwise be blocked by browser isolation.

Details specific to the affected DevTools endpoint are tracked in the upstream bug report referenced by Chromium and remain restricted at the time of publication.

Root Cause

The root cause is missing or insufficient CSRF protection on a DevTools-exposed request handler. Because DevTools handlers can span origin boundaries, the absence of origin or token validation permits attacker-controlled pages to issue requests that DevTools accepts and executes with its normal privileges.

Attack Vector

Exploitation requires user interaction and social engineering. The attacker hosts or delivers a crafted HTML page. When the victim visits the page, embedded content issues forged requests targeting the vulnerable DevTools surface, resulting in a web origin policy bypass. Network-based delivery through phishing, malicious ads, or compromised sites is the expected distribution path.

Refer to the Chromium issue tracker entry #511791538 and the Google Chrome Stable Channel Update for technical details as they become public.

Detection Methods for CVE-2026-95362

Indicators of Compromise

Chrome browser processes running versions earlier than 154.0.8037.57 after the patch release date
Outbound requests from user endpoints to unfamiliar domains hosting HTML content that references DevTools protocol endpoints
Browser telemetry showing unexpected DevTools activation or chrome-devtools:// navigations initiated from web content

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build below 154.0.8037.57
Inspect web proxy and DNS logs for user visits to newly registered domains delivering suspicious HTML payloads
Correlate browser version telemetry with phishing indicators from email security gateways to identify at-risk sessions

Monitoring Recommendations

Enable enterprise browser reporting to centralize Chrome version and extension state across the fleet
Alert on Chrome processes launched with debugging or DevTools-related command-line flags outside expected developer groups
Track patch compliance rates for Chrome and other Chromium-based browsers as an ongoing metric

How to Mitigate CVE-2026-95362

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all Windows, macOS, and Linux endpoints
Force browser restarts to ensure the patched binary is loaded rather than the previously running process
Communicate phishing awareness guidance to users, emphasizing the risk of opening untrusted HTML attachments or links

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog post. Administrators should validate that managed Chrome deployments have picked up build 154.0.8037.57 or newer. Downstream Chromium-based browsers should be updated once their vendors incorporate the corresponding Chromium change.

Workarounds

Restrict browsing to trusted sites via enterprise URL filtering until patching completes
Disable or restrict DevTools access for non-developer user groups using the DeveloperToolsAvailability enterprise policy
Deploy email and web filtering rules to block delivery of suspicious HTML content used in social engineering campaigns

bash

# Enterprise policy example (Chrome DeveloperToolsAvailability)
# Windows registry (HKLM):
#   Software\Policies\Google\Chrome\DeveloperToolsAvailability = 2
# Value 2 = DeveloperToolsDisallowed

# macOS (plist):
defaults write com.google.Chrome DeveloperToolsAvailability -integer 2

# Linux (managed policy JSON at /etc/opt/chrome/policies/managed/):
{
  "DeveloperToolsAvailability": 2
}