CVE-2026-95336 in Chrome
Summary
by MITRE • 09/29/2026
Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within the Transactions Platform of Google Chrome, specifically in versions preceding 154.0.8037.57, represents a significant information disclosure flaw that undermines user privacy and data integrity. This issue stems from an improper handling of sensitive transactional data by the browser's internal components responsible for managing financial interactions or payment-related APIs. The core technical flaw involves insufficient sanitization or access control mechanisms when processing inputs derived from external web pages. When a malicious actor constructs a specially crafted HTML page, they can exploit this weakness to trigger unintended read operations on protected memory regions or sensitive application states that are not meant to be exposed to untrusted contexts. This type of error is characteristic of CWE-200, which defines an Information Exposure vulnerability where security-sensitive information is disclosed without proper access controls. The flaw allows the browser to inadvertently leak data such as transaction identifiers, account details, or session tokens back to the originating malicious script through side channels or direct DOM manipulation techniques that bypass standard sandboxing restrictions intended for third-party content.
From a tactical perspective, this vulnerability relies heavily on social engineering to achieve its objective. A remote attacker cannot exploit this flaw autonomously without user interaction because modern browsers enforce strict same-origin policies and cross-site scripting protections by default. The attack vector requires the victim to visit a malicious website designed specifically to probe for these information leaks. Once the crafted HTML page is loaded, it executes scripts that attempt to extract sensitive data from the Transactions Platform's internal state. This aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, where attackers use legitimate system tools or browser features to execute malicious logic. Furthermore, the exfiltration of this data corresponds to T1048, Exfiltration Over Alternative Protocol, as the attacker may encode the stolen information into HTTP requests or other network traffic to send it back to a command and control server. The severity is rated as Medium because while the impact on confidentiality is high for targeted individuals, the requirement for user interaction limits the blast radius compared to fully remote exploits that require no clicks.
The operational impact of this vulnerability extends beyond simple data theft; it facilitates broader identity fraud and financial loss. By obtaining sensitive transactional information, an attacker can build a detailed profile of a victim's spending habits, account balances, or recent purchases. This intelligence is invaluable for crafting highly convincing phishing campaigns or targeted social engineering attacks that appear legitimate because they reference real-time personal details. Additionally, if the leaked data includes session tokens or authentication cookies associated with financial platforms, it could lead to unauthorized access to banking portals or e-commerce accounts. The breach of trust in the browser's ability to isolate sensitive web applications from general browsing contexts erodes user confidence and highlights the ongoing challenge browsers face in balancing functionality for complex web apps like digital wallets against strict security boundaries.
To mitigate this risk, users must ensure that their Google Chrome installation is updated to version 154.0.8037.57 or later, where these access control checks have been hardened and input validation has been strengthened within the Transactions Platform codebase. Security administrators should enforce automatic update policies across all endpoints to minimize exposure windows for known vulnerabilities. For developers integrating with browser-based transaction APIs, it is critical to implement strict Content Security Policy directives that restrict data exfiltration attempts via script execution. Additionally, adopting defense-in-depth strategies such as enabling site isolation features ensures that even if a vulnerability in one process is exploited, the attacker cannot easily access memory from other processes containing sensitive financial data. Regular security audits of web applications using these APIs can also help identify improper handling of transaction states before they are deployed to production environments.