CVE-2026-95370 exploits an improper implementation in Chrome’s NFC handling that allows a remote attacker to bypass system access restrictions through a crafted HTML page. The flaw lets the browser perform privileged operations that it should not be allowed to execute, effectively giving an attacker unauthorized system access. The weakness is classified as CWE‑841, an inappropriate access control vulnerability.

All desktop installations of Google Chrome dated before version 154.0.8037.57 are affected. Users running these older builds on Windows, macOS, or Linux systems face the vulnerability.

The exploitation path is remotely reachable via a malicious web page that invokes the NFC API. EPSS score is <1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation yet. Chromium labels the issue as medium severity with a CVSS score of 5.4, suggesting that if the affected version remains in use, exploitation could pose a non‑negligible threat. Updating to the patched version is the most effective mitigation.