EUVD-2026-89215
GHSA-mwm5-9w9p-wvg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
DeliveryLure victim to open in Chrome
-
ExploitTrigger use-after-free via crafted content
-
ExecutionCorrupt freed object memory
-
ImpactExecute attacker code across scope boundary
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content in a vulnerable Google Chrome desktop build (UI:R) - a malicious or compromised page, or malicious content loaded within a page. No authentication is needed (PR:N) and the vector is network/web (AV:N) with low complexity (AC:L). Limiting factors: user interaction is mandatory (victim must navigate to/render the page), and users on the patched Sept 2026 stable channel or later are not affected. The exact affected component and version range are not specified in the provided data (description unknown), so precise triggering conditions could not be confirmed. |
| Impact | This is a genuine high-priority issue on signal balance. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, C:H/I:H/A:H, score 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free with a scope change and full CIA impact - the canonical profile of a Chrome renderer memory-corruption bug driven by a malicious web page. EPSS is not provided and the CVE is NOT on CISA KEV, and no public exploit is referenced, so there is no confirmation of active or imminent exploitation; risk is driven by product ubiquity and impact potential rather than by demonstrated in-the-wild use. Note the data gap: the description is '[Unknown description]', so all technical specifics (affected component, renderer vs. browser process) are inferred from CWE-416, the tags, and the Chromium issue reference (552665794), not stated - verify the exact affected component with the Google Chrome release advisory. UAF bugs in Chrome are historically a common target for exploit-chain development, so the effective priority is high (patch fast) even absent KEV/POC signals. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page and lures a victim into visiting it in a vulnerable Chrome desktop build. Content on the page triggers a use-after-free in the affected component, corrupting memory to achieve code execution in the browser context (scope change per S:C). No public exploit is identified at time of analysis, and successful exploitation requires the victim to load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
A use-after-free in Google Chrome desktop can be triggered when a victim renders attacker-controlled web content, allowing memory corruption that may lead to code execution or disclosure of sensitive in-process data. Affected are Chrome desktop builds on Windows, macOS, and Linux prior to the September 2026 stable channel update; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) requires no authentication or privileges but does require the victim to open or load a malicious or compromised page, and the S:C metric indicates the attack can affect a component beyond the one that is corrupted. Vendor-released patch available; no public exploit identified at time of analysis, and the reporting originator is Ubuntu.
Earlier versions of this analysis (1)
Ubuntu Linux is the only entity linked to CVE-2026-95313 in the available intelligence, which consists solely of a report attribution to the Ubuntu vendor security tracker with no description, no CVSS score or vector, no CWE, and no CPE data. Because the affected package, component, version range, and vulnerability class are all unknown, real-world risk cannot be assessed from the provided data. No public exploit identified at time of analysis, no EPSS score or CISA KEV entry accompanies the record, and authentication requirements are not confirmed from available data.
RemediationAI
Vendor-released patch: update Google Chrome to the September 2026 stable channel release or later, per the advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; the corresponding patch is documented as available from the vendor, and the fixed build is identified by that channel release rather than by a specific version number in the provided data. Because the trigger requires the victim to load attacker-controlled content (UI:R), accelerate update enforcement first on hosts and user groups that browse untrusted sites or open untrusted links, and verify the deployed version rather than relying on the browser's background updater alone, since staged rollouts can leave endpoints behind. If immediate fleet-wide updating is not possible, the workable compensating controls are to restrict the affected host populations to a curated allowlist of trusted sites and to disable or block rendered rich content and untrusted file downloads through enterprise policy (allowlist/blocklist URL policies and download restrictions) - the trade-off is reduced productivity and support overhead for legitimate sites that no longer load. Chromium's multi-process sandbox and Site Isolation reduce the reach of a renderer memory-corruption bug but do not eliminate it, and the CVSS S:C score indicates impact can cross a component boundary, so they should be treated as blast-radius reduction and not as a substitute for patching. Do not rely on extension removal, ad blockers, or script blockers as primary mitigations; they may incidentally break a delivery path but offer no guarantee against a page that the user voluntarily loads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free: a heap object is freed while a stale reference to it is still reachable, so a subsequent access reads or writes memory that may have been reallocated with attacker-influenced contents. In browser engines such as Chromium's renderer, this class of bug is typically reachable from web content through JavaScript/DOM or graphics/worker paths, and the tags attached to this record - Use After Free, Memory Corruption, Information Disclosure - are consistent with a single defect that can both leak memory (disclosure) and be groomed for control-flow corruption. The severity is driven by three vector elements: PR:N and AC:L make the trigger reachable by any remote page without credentials or unusual timing, UI:R reflects that the victim must actually navigate to or load the content, and S:C indicates the exploitation impact crosses a component boundary rather than being confined to the vulnerable object. The affected code component and the precise vulnerable version range are explicitly not identified in the supplied data (the description is unknown and no CPE strings were provided), so the specific reachable API path could not be confirmed; affectedness must therefore be scoped by Chrome channel and release date using the chromereleases.googleblog.com advisory rather than by a component or version token.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Web-delivered UAF needs no privileges but requires the victim to load a page (UI:R); renderer sandbox escape/scope change gives S:C with full CIA impact, matching a Chrome RCE profile.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
A critical memory-corruption flaw in Google Chrome desktop - the browser used across essentially every workstation in the organization - could let an attacker-controlled web page run code on an employee's machine under the user's own credentials. Because the flaw requires no credentials and only that someone visit a malicious or compromised site, ordinary web browsing, phishing, or malvertising is enough to expose any employee on Windows, macOS, or Linux, giving an intruder a foothold inside the corporate network. Google has released a fix, and while no public exploit code is circulating, the breadth of the exposure makes prompt, organization-wide patching a leadership-level priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB