CVE-2026-95373 Overview
CVE-2026-95373 is a use-after-free vulnerability [CWE-416] in the DevTools component of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.57. A remote attacker can exploit this weakness by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. The Chromium project rated this issue as High severity.
The vulnerability requires user interaction and leverages social engineering to trigger the exploitation path within DevTools. Google addressed the flaw in the Stable Channel update tracked under Chromium issue #553130481.
Critical Impact
A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a malicious HTML page that triggers the DevTools use-after-free condition.
Affected Products
- Google Chrome (Desktop) versions prior to 154.0.8037.57
- Chromium-based browsers sharing the affected DevTools code path
- All supported desktop platforms (Windows, macOS, Linux) running vulnerable Chrome builds
Discovery Timeline
- 2026-09-29 - CVE-2026-95373 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-95373
Vulnerability Analysis
CVE-2026-95373 is a use-after-free condition in Chrome DevTools, the built-in developer tooling exposed through the DevTools Protocol and UI. Use-after-free defects occur when code references heap memory after that memory has been freed, allowing an attacker who controls subsequent allocations to influence program state.
In this case, the freed object resides in a code path reachable when a user interacts with a crafted HTML page that manipulates DevTools functionality. The attacker leverages social engineering to induce the required interaction. Once the dangling pointer is dereferenced, controlled data can drive execution flow.
The outcome is arbitrary code execution inside the renderer sandbox. Sandbox execution does not directly grant host access, but it establishes a foothold that adversaries typically combine with a sandbox escape to achieve full compromise.
Root Cause
The root cause is improper lifetime management of a DevTools object [CWE-416]. When the object is released while another reference remains active, subsequent use of that reference operates on reclaimed or reallocated memory. Public technical detail is limited pending the disclosure window on Chromium issue #553130481.
Attack Vector
The attack vector is network-based and requires user interaction. The victim must load a crafted HTML page under attacker control and take an action that engages the vulnerable DevTools code path. No authentication is required. Verified proof-of-concept code is not publicly available. See the Chrome Stable Channel Update for the vendor summary.
Detection Methods for CVE-2026-95373
Indicators of Compromise
- Chrome renderer or DevTools process crashes with heap corruption signatures shortly after visiting an untrusted page
- Unexpected child process creation spawned from chrome.exe following browsing activity
- Outbound connections from browser processes to unfamiliar domains hosting HTML payloads that invoke DevTools functionality
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 154.0.8037.57
- Correlate browser process crashes with recent navigation events in endpoint telemetry to surface potential exploitation attempts
- Monitor for anomalous use of the Chrome DevTools Protocol from unexpected local or remote origins
Monitoring Recommendations
- Ingest browser process telemetry (process creation, module loads, crashes) into a centralized analytics platform for retrospective hunts
- Alert on Chrome child processes executing shell binaries, script interpreters, or LOLBins immediately after browser navigation
- Track egress traffic from browser processes to newly registered or low-reputation domains
How to Mitigate CVE-2026-95373
Immediate Actions Required
- Update Google Chrome to version 154.0.8037.57 or later on all desktop endpoints
- Restart browser sessions after patch deployment to ensure the vulnerable code is unloaded
- Prioritize remediation for users with administrative privileges or access to sensitive systems
Patch Information
Google released a fix in Chrome Stable Channel version 154.0.8037.57. Details are published in the Chrome Stable Channel Update and tracked in Chromium Issue #553130481. Chromium-based browser vendors should incorporate the upstream fix in their next release.
Workarounds
- Enforce enterprise browser update policies to auto-apply Stable Channel updates without user intervention
- Restrict access to untrusted websites via web filtering or DNS-layer controls until patching is complete
- Advise users to avoid interacting with DevTools on unfamiliar pages and to report unexpected browser prompts
# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
