---
id: CVE-2026-95376
title: >-
  Externally controlled reference in DevTools in Google Chrome prior to
  154.0.8037.57 allowed an adjacent attacker leveraging social engineering to
  bypass system access restrictions via crafted network traffic
summary: >-
  Externally controlled reference in DevTools in Google Chrome prior to
  154.0.8037.57 allowed an adjacent attacker leveraging social engineering to
  bypass system access restrictions via crafted network traffic. (Chromium
  security severity:…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-610
vendor: google
product: chrome
affected:
  - chrome < 154.0.8037.57
patched:
  - chrome 154.0.8037.57
published: '2026-09-29'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T14:05:52.733'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95376'
references:
  - url: >-
      https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html
    label: chrome-cve-admin@google.com
  - url: 'https://issues.chromium.org/issues/513134076'
    label: chrome-cve-admin@google.com
  - url: 'https://issues.chromium.org/issues/513134076'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95376.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-95376'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-95376'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00169
epssPercentile: 0.06288
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-30T19:32:38.898403Z'
ingestedAt: '2026-09-29T17:41:02.238Z'
scores:
  nvd: 8
  vendor: 4.6
---

## Overview

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

## Affected

- `chrome < 154.0.8037.57`

## Remediation

Upgrade past the affected range:

- `chrome 154.0.8037.57`

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95376.json)