CVE-2026-95384 in Chrome
Summary
by MITRE • 09/29/2026
Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as a race condition within the Transactions Platform of Google Chrome, specifically affecting versions prior to 154.0.8037.57, represents a significant class of concurrency-related flaws that can lead to information disclosure. This issue arises from improper synchronization mechanisms when handling asynchronous operations or shared resources during transaction processing workflows. In complex web environments like the Chromium engine, multiple threads or execution contexts may attempt to access and modify state variables related to financial transactions or payment data simultaneously without adequate locking or atomicity guarantees. When these race conditions occur, an attacker can exploit the timing window between a check for valid permissions or state consistency and the actual use of that state to manipulate the outcome. This specific flaw allows a remote attacker who hosts or controls a crafted HTML page to trigger this condition through malicious JavaScript execution within the browser context.
From a technical perspective, race conditions in transactional systems often stem from time-of-check-to-time-of-use (TOCTOU) errors where the system verifies that certain preconditions are met but fails to ensure those conditions remain valid when the subsequent action is executed. In the context of Chrome's Transactions Platform, this could involve manipulating internal flags or data structures that dictate how sensitive user information is handled during a transaction flow. By carefully crafting requests and exploiting the precise timing differences in thread scheduling or event loop processing, an attacker can cause the browser to expose memory contents or state variables that were intended to remain isolated from untrusted web content. The severity of this vulnerability is classified as Medium by Chromium security standards because while it does not typically allow for arbitrary code execution or full system compromise on its own, it provides a pathway for sensitive data leakage which undermines user privacy and trust in the platform's ability to secure financial interactions.
The operational impact of this vulnerability centers on the potential exfiltration of sensitive information that should be protected by same-origin policies and sandboxing mechanisms. An attacker leveraging this flaw could potentially read memory regions containing transaction details, authentication tokens, or other personally identifiable information associated with a user’s browsing session if they can induce the race condition in a targeted manner. This type of attack is particularly dangerous because it bypasses traditional security boundaries that rely on static analysis and permission checks, instead exploiting dynamic runtime behavior. The ability to leak sensitive data via a crafted HTML page means that any website visited by an attacker could serve as a vector for this exploit if the user interacts with elements or scripts that trigger the vulnerable code paths in the Transactions Platform. This poses a direct threat to users engaging in online banking, e-commerce transactions, or other activities where confidentiality of transactional data is paramount.
To mitigate the risks associated with this race condition vulnerability, it is imperative for organizations and individual users to update Google Chrome to version 154.0.8037.57 or later as soon as possible. This patch includes fixes that enforce stricter synchronization protocols within the Transactions Platform, ensuring that state checks are atomic and cannot be interleaved with malicious operations from untrusted contexts. Additionally, developers integrating third-party payment solutions should review their implementations for similar concurrency issues, particularly when handling asynchronous callbacks or shared memory segments in web applications. Implementing robust input validation and avoiding reliance on implicit assumptions about execution order can further reduce the attack surface. Security teams should also monitor browser update notifications closely and enforce automatic updates where feasible to ensure that all endpoints are protected against known race condition exploits that target critical platform components like transaction handling systems.
This vulnerability aligns with CWE-362, which describes concurrent access resulting in a race condition, highlighting the importance of proper thread synchronization and atomic operations in software design. Furthermore, it relates to ATT&CK technique T1059, specifically command scripting or execution within browser environments, as attackers utilize crafted HTML pages to execute malicious logic that exploits these timing flaws. Understanding this context helps security professionals prioritize patching efforts and reinforces the need for rigorous testing of concurrency-related code paths in web browsers and their associated APIs. By addressing these underlying architectural weaknesses, developers can prevent similar vulnerabilities from being exploited in future versions, thereby maintaining the integrity and confidentiality of user data processed through the browser's transactional capabilities.