CVE-2026-95376

HighCVSS 8.0/10Last modified Oct 1, 2026

Description

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-610

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-95387.5Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() readCVE-2026-953808.8Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute CVE-2026-953818.3Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proCVE-2026-953826.5Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer processCVE-2026-953845.3Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive infoCVE-2026-953856.5Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveragiCVE-2026-953865.5TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of serviceCVE-2026-953878.8SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-953885.5Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-953898.1SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95396.5An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9CVE-2026-953905.5PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service
CVE-2026-95376: High severity, CVSS 8.0 | Vulnix