CVE-2026-95384: Google Chrome Race Condition Vulnerability

CVE-2026-95384 Overview

CVE-2026-95384 is a race condition vulnerability in the Transactions Platform component of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.57 on desktop platforms. A remote attacker can exploit the issue through a crafted HTML page to potentially leak sensitive information. Exploitation requires user interaction, such as visiting an attacker-controlled page. Google classified the Chromium security severity as Medium. The vulnerability maps to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
A remote attacker can leverage timing conditions in the Transactions Platform to leak sensitive information from the browser process via a crafted web page.

Affected Products

Google Chrome for Desktop prior to 154.0.8037.57
Chromium-based browsers incorporating the vulnerable Transactions Platform code
Downstream distributions bundling Chromium before the fixed release

Discovery Timeline

2026-09-29 - CVE-2026-95384 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95384

Vulnerability Analysis

The vulnerability resides in the Transactions Platform subsystem of Chrome. A race condition occurs when concurrent operations access shared state without proper synchronization. An attacker who wins the race can observe data that should remain isolated between execution contexts. The result is unintended disclosure of sensitive information to attacker-controlled JavaScript running on a crafted page. Successful exploitation requires the victim to load the malicious content in an unpatched Chrome build. The attack complexity is high because the attacker must reliably trigger the timing window across varied hardware and system loads.

Root Cause

The defect is a synchronization flaw [CWE-362] in the Transactions Platform. Multiple threads or asynchronous tasks operate on shared data without adequate locking or ordering guarantees. Under specific interleavings, sensitive state becomes observable to code that should not have access to it.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page that issues sequences of DOM, storage, or transaction API calls designed to provoke the race. When a victim visits the page in a vulnerable Chrome version, the browser exposes information that the attacker's script can read. No credentials or elevated privileges are required. Technical specifics are tracked in Chromium Issue Tracker #526550688.

Detection Methods for CVE-2026-95384

Indicators of Compromise

Browser telemetry showing Chrome versions below 154.0.8037.57 navigating to untrusted origins
Web proxy logs recording repeated visits to pages that issue high-frequency transaction or storage API calls
JavaScript payloads that spawn many concurrent workers or asynchronous fetches targeting the same shared state

Detection Strategies

Inventory installed Chrome builds across managed endpoints and flag any version prior to the fixed release
Correlate browser process telemetry with outbound requests to newly registered or low-reputation domains
Inspect content delivery paths for HTML pages that programmatically stress transaction-related web APIs

Monitoring Recommendations

Ingest browser version and update-state events into the security data lake for continuous version compliance checks
Alert on Chrome installations that fail to update within the organization's patch service-level objective
Monitor endpoint process telemetry for anomalous Chrome renderer crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-95384

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update installs so the patched binaries load into memory
Validate that managed browser update policies are enforced and not disabled by end users

Patch Information

Google released the fix in the Chrome Stable channel. See the Google Chrome Stable Update advisory for release details and the Chromium Issue Tracker entry #526550688 for the underlying bug reference. Chromium-based browser vendors should incorporate the upstream fix and ship updated builds to their users.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until the update is deployed
Disable or limit JavaScript execution on untrusted origins via browser policy where operationally feasible
Deploy site isolation and strict same-origin policies to reduce cross-context data exposure

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update check via enterprise policy (Windows registry example)
# HKLM\Software\Policies\Google\Update
#   UpdateDefault = 1 (always update)
#   AutoUpdateCheckPeriodMinutes = 60