EUVD-2026-89239
GHSA-94jv-chph-pqrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted script triggering type confusion
-
ExploitCorrupt object of confused type
-
ExecutionAchieve renderer memory control
-
ImpactExecute attacker code in browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to interact with attacker-controlled web content (UI:R) - visiting a malicious page or one serving malicious script in Google Chrome; no authentication is required (PR:N) and the attack is network-delivered (AV:N) at low complexity (AC:L). The primary limiting factor is that a user must actively browse to or engage with the malicious content; there is no server-side or passive-network trigger. Because scope is unchanged (S:U), full-system compromise as scored would additionally depend on Chrome's sandbox not being escaped by this bug alone, likely requiring a chained second vulnerability for privilege/boundary escape. Patched Chrome versions from the September 2026 stable-channel update are not affected. |
| Impact | This is a genuine high-priority issue driven primarily by product ubiquity rather than confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R) - i.e., a victim must visit or interact with a malicious page. CWE-843 (type confusion) in a browser is a classic memory-corruption primitive that historically leads to remote code execution in the renderer process. Notably the scope is UNCHANGED (S:U), meaning the impact as scored is contained to the exploited process/security authority and does NOT itself assert a sandbox escape - this distinguishes it from the S:C siblings in the same Chrome batch (e.g., CVE-2026-95313/95350/95357) which do model cross-boundary impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is NO evidence of active or automated exploitation at this time; the risk is potential/latent, not demonstrated. Signals are largely consistent (network drive-by memory corruption), but the vendor description is absent - the CWE, tags, and Chrome release context are the only substantive basis, so confidence in the precise mechanism is moderate. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing JavaScript that triggers a type-confusion condition in a Chrome component, corrupting memory when a victim browses to it. With a reliable exploit, this typically yields code execution within the renderer process, potentially chained with a separate sandbox-escape bug for full compromise. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Type confusion in Google Chrome's renderer allows remote attackers to corrupt memory and potentially achieve code execution inside the browser by convincing a victim to open a crafted web page; the attack is network-delivered, requires no authentication (PR:N), and has low complexity, with the only meaningful barrier being that the user must interact with attacker-controlled content (UI:R). A vendor patch is available per the September 2026 stable-channel update, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the high priority here is driven mainly by Chrome's ubiquity rather than observed attacks. Because the CVSS scope is unchanged (S:U), full-system compromise as scored would likely require chaining this bug with a separate sandbox-escape vulnerability, while on its own the flaw is expected to yield renderer-level memory corruption, information disclosure, and potential arbitrary code within the sandboxed process.
Earlier versions of this analysis (1)
Ubuntu is the only affected product identified for CVE-2026-95286, based solely on a vendor-sourced Ubuntu record; no description, CVSS vector, CWE, affected package, or version range was provided, so the underlying defect and its impact cannot be characterized. Because the vulnerability type, attack vector, and authentication requirements are all unknown, no defender-facing statement about exploitability is possible, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the provided data; the authoritative details must be pulled from the Ubuntu Security Notice for CVE-2026-95286 and the corresponding NVD record before triage or prioritization decisions are made.
RemediationAI
Update Chrome to the version published in the September 2026 stable-channel update referenced in the advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); the input data confirms a vendor patch is available but does not supply the exact fixed version string, so verify the installed build via chrome://version and compare it against the Chrome Releases post rather than assuming an arbitrary number. Restart the browser after updating, since a stale renderer process can keep the vulnerable code resident, and enforce auto-update through enterprise policy so hosts do not drift. On Ubuntu and other distributions that package Chromium downstream (the reporting vendor here is vendor:ubuntu), apply the corresponding distribution security update once it is published, or switch affected users to a browser build that has already been rebased on the patched upstream revision. If immediate patch deployment is not possible, the most effective compensating control is to keep Chrome's Site Isolation and the V8 sandbox enabled at their defaults and refuse any deployment configuration that disables them - this does not fix the type confusion but materially limits its ability to cross from the renderer into other origins or processes, at the cost of higher memory usage. Additional risk reduction with trade-offs includes blocking untrusted or unknown extensions (which run with elevated page privileges and can widen the attack surface), restricting browsing of untrusted content through enterprise URL filtering or a hardened, isolated profile, and disabling unnecessary JIT-heavy features only as a last resort, since JIT restrictions (e.g., --jitless style hardening) cause significant performance regressions and may break sites. None of these workarounds addresses the underlying memory-corruption flaw; patching remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a type confusion (CWE-843), a class of memory-safety defect in which code operating on an object or buffer assumes a type that does not match the object actually allocated or passed to it. In a Chromium/Chrome context this typically surfaces in the JavaScript engine (V8) or in Blink's DOM bindings, where a mismatch between the expected and actual object layout causes out-of-bounds reads or writes, miscomputed field offsets, or the reinterpretation of one structure as another. The accompanying tags - Information Disclosure and Memory Corruption - are consistent with a bug that first leaks or manipulates memory and can be escalated into control-flow hijacking if the corrupted data can be shaped by the attacker. Chrome's multi-process architecture places this logic inside the renderer sandbox, so the directly achievable impact is confined to that sandboxed process; reaching the OS or other processes generally requires a second, chained bug to escape the sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms a remote, unauthenticated, low-complexity trigger that depends on user interaction with web content, with scope unchanged. No CPE strings were supplied in the input, so the affected product scope is derived from the vendor advisory, which is the Chrome Desktop stable channel (and Chromium-derived builds that follow it, including the Ubuntu-packaged Chromium reported by vendor:ubuntu).
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network drive-by type confusion requiring a victim to load malicious content (UI:R, PR:N, AC:L); impact contained to the exploited process (S:U) with full C/I/A loss from memory corruption.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome's widespread enterprise use makes a high-severity renderer type-confusion flaw a broad organizational risk, with unpatched users potentially exposed to memory corruption or sandboxed code execution when they open a crafted web page. No public exploit identified at time of analysis, but the flaw is remotely deliverable, unauthenticated, and requires only user interaction, so browser patch coverage should be treated as time-sensitive. Leadership should care because any delay keeps a ubiquitous, easily targeted application in scope across the workforce.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB