Description
Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)
Published: 2026-09-29
Score: 2.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Local memory read via unchecked return value
Action: Patch
AI Analysis

Impact

The flaw is an unchecked return value in Chrome’s Performance code. An attacker who can run a local program on the same user session may use it to read arbitrary memory belonging to the Chrome process. The impact is a local memory disclosure, not a code execution or denial of service. This reflects the weakness identified by CWE-252.

Affected Systems

All installations of Google Chrome older than 154.0.8037.57 are affected. The issue is present on every platform where Chrome’s Performance component is used (Windows, macOS, Linux, etc.).

Risk and Exploitability

The CVSS score of 2.9 indicates a low overall severity. Because the exploit requires local access, the EPSS score is not available and the vulnerability is not present in CISA’s KEV catalog. The attack would need the attacker to run a local program with the same privileges as the user running Chrome, so the risk is limited to local attackers.

Generated by OpenCVE AI on September 30, 2026 at 12:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 154.0.8037.57 or later.
  • Ensure Chrome’s automatic update feature is enabled so future fixes are applied promptly.
  • Restrict local user accounts from executing arbitrary programs by enforcing least‑privilege policies or using application whitelisting tools.

Generated by OpenCVE AI on September 30, 2026 at 12:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Wed, 30 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unchecked Return Value Allows Local Memory Read in Chrome Performance chromium-browser: chromium-browser: Unchecked return value in Performance
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unchecked Return Value Allows Local Memory Read in Chrome Performance

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)
Weaknesses CWE-252
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T19:15:21.829Z

Reserved: 2026-09-22T05:08:43.660Z

Link: CVE-2026-95316

cve-icon Vulnrichment

Updated: 2026-09-29T19:15:17.599Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:23.807

Modified: 2026-09-30T16:29:33.340

Link: CVE-2026-95316

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-29T17:32:00Z

Links: CVE-2026-95316 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T12:15:17Z

Weaknesses