CVE-2026-95367 in Chrome
Summary
by MITRE • 09/29/2026
Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an information leak within the DataTransfer object in Google Chrome prior to version 154.0.8037.57 represents a significant breach of browser isolation principles, specifically targeting the boundary between renderer processes and user data. This flaw allows for the exfiltration of sensitive clipboard contents or other transferred data when an attacker successfully compromises a renderer process through social engineering tactics. The severity is classified as low by Chromium security standards, yet the implications remain serious due to the potential exposure of personally identifiable information or confidential documents that users may have copied without realizing they are interacting with malicious content.
At its core, this vulnerability exploits the way web pages interact with the browser's clipboard API and DataTransfer interface. When a user copies data from one application into their system clipboard, it is stored in memory accessible to various processes under specific conditions. If an attacker can trick a victim into visiting a crafted HTML page while having sensitive information on their clipboard, the compromised renderer process associated with that tab may be able to read this data without proper authorization checks or sandboxing restrictions. This bypasses intended security controls designed to prevent web content from accessing user clipboard contents unless explicitly permitted by the user through an interaction event such as a paste action.
The operational impact of this vulnerability centers on unauthorized access to sensitive information, which can lead to identity theft, financial loss, or corporate espionage depending on the nature of the copied data. Attackers typically leverage social engineering techniques, such as phishing emails or malicious websites disguised as legitimate services, to induce users into copying confidential text while having the attacker's page open in a background tab or active window. Once executed, the exploit silently retrieves the clipboard contents and transmits them back to the remote server controlled by the adversary. This process occurs without any visible indication to the user, making detection difficult and increasing the likelihood of successful data exfiltration.
From a classification perspective, this issue aligns with CWE-200: Information Exposure, where security-relevant information is disclosed to an unauthorized actor. It also relates to ATT&CK technique T1567.002: Exfil Over Alternative Protocol via Web Service, as the stolen data is often sent out using standard HTTP or HTTPS requests embedded within malicious JavaScript code. The vulnerability highlights the ongoing challenge browsers face in maintaining strict isolation between untrusted web content and local system resources like the clipboard, especially when multiple tabs are open simultaneously.
Mitigation strategies primarily involve updating Google Chrome to version 154.0.8037.57 or later, where these access controls have been tightened to ensure that only explicit user interactions trigger clipboard reads. Users should remain vigilant against social engineering attempts and avoid copying sensitive information while browsing unfamiliar websites. Additionally, employing browser extensions that manage permissions for clipboard access can provide an additional layer of defense by prompting users before any web page is allowed to read their clipboard data. Regularly updating browsers ensures that known vulnerabilities are patched promptly, reducing the window of opportunity for attackers exploiting these flaws.