CVE-2026-95381 reveals an improper input validation flaw in Google Chrome’s printing subsystem. A crafted HTML page delivered to a user can be used by an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, compromising confidentiality, integrity, and availability of the affected system.

The vulnerability exists in Google Chrome desktop releases prior to 154.0.8037.57. Users running those versions are impacted; versions 154.0.8037.57 and later are no longer vulnerable.

The CVSS score of 8.3 indicates a high severity issue, while the EPSS score is not available, making the current exploitation likelihood uncertain. The flaw is not listed in the CISA KEV catalog. Exploitation requires a compromised renderer process, so the attack vector is not a remote network attack but can be triggered from a maliciously crafted HTML page once renderer access is achieved. Monitoring for unusual rendering activity and applying the patch is recommended.