CVE-2026-95274

chromium-browser: chromium-browser: Improper output encoding in DevTools

View on CVE.org
Published Sep 29, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Description
Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

Improper output encoding in the DevTools component of Google Chrome allowed a remote attacker who compromised the renderer process to potentially execute arbitrary code outside the sandbox by loading a crafted HTML page. This flaw corresponds to the improper encoding weakness (CWE-116) as well as the unintended native code execution weakness (CWE-838) and carries a high severity rating with a CVSS score of 8.3, indicating loss of confidentiality, integrity, and availability for the vulnerable system.

Affected Systems

The vulnerability affects Google Chrome browsers running versions prior to 154.0.8037.57. Users operating any earlier stable channel release are subject to risk until they upgrade to the patched build.

Risk and Exploitability

The CVSS score indicates significant risk; the EPSS score of < 1% and no listing in the KEV catalog suggest exploitation may not be widespread yet. Based on the description, it is inferred that an attacker must successfully subvert the renderer process, after which the flaw can be leveraged to escape the sandbox and run code with elevated privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or later
  • If a timely upgrade is not possible, disable DevTools or restrict its access to trusted content to limit the opportunity for crafted HTML to influence the renderer
  • Monitor browser logs for anomalous renderer behavior and enforce the Chrome sandbox settings to mitigate potential escape attempts

Generated by OpenCVE AI on October 1, 2026 at 03:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History
Type Values Removed Values Added
Title Improper DevTools Output Encoding Enables Remote Execution in Chrome chromium-browser: chromium-browser: Improper output encoding in DevTools
Weaknesses CWE-838
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Improper DevTools Output Encoding Enables Remote Execution in Chrome
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-116
References
Earlier changes (1)
Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-838

    Inappropriate Encoding for Output Context

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 30, 2026, 3:56 AM
Reserved
Sep 22, 2026, 5:06 AM

View source JSON

Updated
Sep 29, 2026, 6:17 PM

JSON

Status
Analyzed
Published
Sep 29, 2026, 6:17 PM
Modified
Sep 30, 2026, 4:38 PM

View source JSON

Severity
Important
Public date
Sep 29, 2026, 5:31 PM

View source Bugzilla JSON

Updated
Oct 1, 2026, 4:00 AM

JSON