Description
Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-29
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential Information Leak via crafted HTML page
Action: Patch Chrome
AI Analysis

Impact

A race condition exists in the Transactions Platform component of Google Chrome before version 154.0.8037.57. The flaw, identified as CWE‑362, can be triggered by a specially crafted HTML page that a user opens, potentially allowing a remote attacker to read or expose sensitive data. It does not provide an arbitrary code execution pathway.

Affected Systems

Google Chrome desktop browsers on Windows, macOS and Linux running any version earlier than 154.0.8037.57 are affected. The issue is confined to the Transactions Platform and has been resolved in release 154.0.8037.57 and later.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS information is not available and the flaw is not listed in CISA's KEV catalog, indicating no known public exploits at present. The likely attack vector involves a victim visiting a crafted HTML page; no elevated privileges or additional software are required. The primary risk is the potential disclosure of sensitive information if the race condition is successfully triggered.

Generated by OpenCVE AI on September 30, 2026 at 10:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or later
  • Configure Chrome to automatically install security updates
  • Disable non‑essential extensions or features that might interact with the Transactions Platform until the update is applied

Generated by OpenCVE AI on September 30, 2026 at 10:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Race condition in Transactions Platform
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 30 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome Allows Information Leakage

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome Allows Information Leakage

Tue, 29 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-362
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T21:13:00.068Z

Reserved: 2026-09-22T05:25:57.879Z

Link: CVE-2026-95384

cve-icon Vulnrichment

Updated: 2026-09-29T21:12:52.767Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:32.150

Modified: 2026-10-02T15:12:31.877

Link: CVE-2026-95384

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T17:31:51Z

Links: CVE-2026-95384 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T10:45:17Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')