Description
Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-09-29
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Improper output encoding in the DevTools component of Google Chrome allowed a remote attacker who compromised the renderer process to potentially execute arbitrary code outside the sandbox by loading a crafted HTML page. This flaw corresponds to the improper encoding weakness (CWE-116) as well as the unintended native code execution weakness (CWE-838) and carries a high severity rating with a CVSS score of 8.3, indicating loss of confidentiality, integrity, and availability for the vulnerable system.

Affected Systems

The vulnerability affects Google Chrome browsers running versions prior to 154.0.8037.57. Users operating any earlier stable channel release are subject to risk until they upgrade to the patched build.

Risk and Exploitability

The CVSS score indicates significant risk; the EPSS score of < 1% and no listing in the KEV catalog suggest exploitation may not be widespread yet. Based on the description, it is inferred that an attacker must successfully subvert the renderer process, after which the flaw can be leveraged to escape the sandbox and run code with elevated privileges.

Generated by OpenCVE AI on October 1, 2026 at 03:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or later
  • If a timely upgrade is not possible, disable DevTools or restrict its access to trusted content to limit the opportunity for crafted HTML to influence the renderer
  • Monitor browser logs for anomalous renderer behavior and enforce the Chrome sandbox settings to mitigate potential escape attempts

Generated by OpenCVE AI on October 1, 2026 at 03:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Improper DevTools Output Encoding Enables Remote Execution in Chrome chromium-browser: chromium-browser: Improper output encoding in DevTools
Weaknesses CWE-838
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 30 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Improper DevTools Output Encoding Enables Remote Execution in Chrome

Tue, 29 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-116
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-30T03:56:38.057Z

Reserved: 2026-09-22T05:06:44.638Z

Link: CVE-2026-95274

cve-icon Vulnrichment

Updated: 2026-09-29T18:17:48.818Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:18.553

Modified: 2026-09-30T16:38:00.633

Link: CVE-2026-95274

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-29T17:31:40Z

Links: CVE-2026-95274 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T04:00:14Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-838

    Inappropriate Encoding for Output Context