EUVD-2026-89244Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted content triggering type confusion
-
ExploitCorrupt renderer memory via mismatched object type
-
ExecutionAchieve code execution in renderer sandbox
-
ImpactAccess sensitive browser data / stage sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively load attacker-controlled web content in a vulnerable Chrome build (below 154.0.8037.57) - the UI:R user-interaction requirement (visiting a malicious or compromised page) is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and exploitation works against default Chrome configurations since the type-confusion path is in core rendering, not a non-default feature. The renderer-only scope (S:U) means the memory corruption is initially confined to the sandboxed renderer process; full system compromise would require an additional sandbox-escape chain not described here. |
| Impact | This is a genuinely high-priority browser flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated type-confusion (CWE-843) bug that yields full confidentiality, integrity, and availability impact within the renderer sandbox, requiring only that a victim visit a malicious page (UI:R). Type-confusion bugs in Chrome are historically a reliable path to renderer RCE and are frequently chained toward sandbox escape, so real-world weaponization potential is high. However, no EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the 8.8 reflects potential, not observed, exploitation. A patch is confirmed available from Google (stable channel update), which is the decisive mitigation. The 'Information Disclosure' tag understates the flaw: with I:H and A:H this is memory corruption / potential code execution, not a mere read primitive. Net: treat as high priority for patch rollout given Chrome's ubiquity and the bug class, while noting that current telemetry shows no active exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted JavaScript/content that triggers the type-confusion condition when rendered by Chrome. A victim on a vulnerable version (below 154.0.8037.57) visits the page, and the mismatched object type interpretation corrupts memory in the renderer process, enabling attacker-controlled code execution within the sandbox. No public proof-of-concept is identified at time of analysis; exploitation requires user interaction (visiting the page) but no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Type confusion in Google Chrome's core rendering code allows remote attackers to corrupt memory and execute arbitrary code inside the browser renderer, affecting Chrome builds prior to 154.0.8037.57 on all platforms. Exploitation requires the victim to load attacker-controlled web content (a malicious or compromised page), matching the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H profile - no credentials are needed, and default configurations are exposed because the flaw sits in normal rendering rather than an optional feature. At the time of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; the impact is contained to the sandboxed renderer (S:U), so full host compromise would require a separate sandbox escape not described in this record, but the integrity and confidentiality impact within the renderer is high and the issue is rated 8.8.
Earlier versions of this analysis (1)
The only intelligence available for CVE-2026-95306 is that it was reported through the Ubuntu vendor channel, indicating an affected package somewhere in the Ubuntu/Debian software ecosystem; the CVE record itself carries an '[Unknown description]', no CVSS score or vector, no CWE mapping, no CPE data, and no reference list. Because neither the vulnerable component, the affected Ubuntu release, nor the attack preconditions can be determined from the supplied data, the practical impact on any given deployment is currently unquantifiable. No KEV entry and no public proof-of-concept were provided, so no public exploit is identified at time of analysis - but this reflects the absence of data rather than an affirmative finding of non-exploitability.
RemediationAI
Upgrade to Google Chrome 154.0.8037.57 or later - Vendor-released patch: 154.0.8037.57 - which is the first stable build containing the fix for this type confusion; use the built-in updater (chrome://settings/help) or your platform's package mechanism, and confirm the reported version reaches 154.0.8037.57 or higher. The authoritative vendor guidance is Google's Stable Channel Update for Desktop advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html), with the technical detail at https://issues.chromium.org/issues/560536735. Ubuntu and other Chromium repackagers should apply the corresponding chromium package update rather than relying on the Chrome package alone, and managed fleets should enforce a minimum-version policy via enterprise policy to prevent version rollback. If immediate patching is not possible, compensating controls include enabling and enforcing Site Isolation (trade-off: modest memory/CPU overhead and, for some enterprise SSO or embedded-app flows, broken cross-origin frames) and restricting users to trusted web content through proxy/URL filtering allowlists, since exploitation requires the victim to load attacker-controlled content (trade-off: reduced browsing utility and possible false-positive blocks). Disabling JavaScript or using a strict content-security policy for high-risk browsing reduces the attack surface (trade-off: many sites become unusable), and running the browser in a disposable VM or container with no access to corporate credentials limits post-exploitation value given the renderer-only scope. Because the flaw is a type confusion that can be chained with a separate sandbox escape, treat any suspected exploitation as a potential full-client compromise and rotate credentials stored in the browser profile.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-843 (Access of Resource Using Incompatible Type / type confusion), a class of memory-safety bug in which an object of one type is handled as another, typically through a mismatched pointer or vtable-like dispatch, leading to out-of-bounds reads/writes and attacker-controllable memory corruption. The vendor tags for this record - 'Memory Corruption' and 'Information Disclosure' - align with that dual consequence: a type confusion can both leak heap layout/pointers (useful for defeating ASLR and building exploitation primitives) and provide a write primitive. The flaw is reachable from web content rendered in Chrome, and the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates a network-delivered trigger with low attack complexity and no privileges, gated only by user interaction. Scope is unchanged in the CVSS sense, which reflects that the corruption occurs in the sandboxed renderer process; the upstream Chromium issue tracker entry (issues.chromium.org/issues/560536735) and the Stable Channel update advisory are the authoritative technical sources, and the fix shipped in the Chrome 154.0.8037.57 stable build. Because the affected component is part of the core browser rather than an extension or non-default feature, Chromium-derived distributions such as Ubuntu's chromium package, reported as the submitting vendor, must track the same upstream fix.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network drive-by via malicious page (AV:N, UI:R), no privileges (PR:N), type confusion gives full renderer C/I/A; scope unchanged (S:U) as impact is renderer-contained.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome builds prior to 154.0.8037.57 on every supported platform carry a memory-corruption flaw that any malicious or compromised web page can trigger in an ordinary employee browsing session, so the exposure spans the entire workforce rather than a narrow set of servers. A compromised browser renderer can read or alter data handled within that tab - including session tokens and credentials visible to the page - making this a fleet-wide endpoint hygiene issue for IT and security leadership. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so current risk is driven by the sheer size of the browser footprint rather than observed attack activity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
GitHub PoC
Exploit-DB