EUVD-2026-89123
GHSA-hq2m-gw4f-4895
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted content exploiting authorization check
-
ExecutionBypass origin/permission boundary in Chrome
-
ImpactAccess or modify protected cross-origin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to 154.0.8037.57 to interact with attacker-controlled web content (UI:R) - typically visiting a malicious or compromised page - so it is not fully drive-by and depends on user action. No authentication is required (PR:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factors are the required user interaction and the need for the victim to be on an unpatched Chrome version; the vendor fix in 154.0.8037.57 and later removes the exposure. Availability is unaffected (A:N), so impact is confined to confidentiality and integrity of accessible data. |
| Impact | The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity authorization flaw (CWE-863) in Google Chrome that needs no privileges but does require user interaction (UI:R) - consistent with a victim visiting a malicious web page. The real-world exploitation signals are notably weaker than the base score: EPSS is only 0.22% (12th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced, so this is a high-severity-but-low-observed-risk issue at the time of analysis. The high score is driven by Chrome's ubiquity and the C:H/I:H impact rather than by evidence of mass exploitation. One data conflict to flag: CWE-863 and the base vector describe an authorization/same-origin style bypass, yet the input Tag labels this 'Authentication Bypass' - these are related but distinct, and the actual description is '[Unknown]', so the precise bug class cannot be confirmed from the provided data. Recommendation: patch promptly given Chrome's footprint and the A:N/UI:R profile typical of browser same-origin bugs, but there is no current signal of active or widespread exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Chrome user (version below 154.0.8037.57) to visit it. Because the flaw is a network-reachable authorization bypass requiring only a page visit (UI:R), the page abuses the weakness to read or alter data the attacker should not be able to access (C:H/I:H), such as content or state from another origin. No public exploit code is referenced, so this scenario is inferred from the CVSS vector rather than a known POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 01, 2026
Incorrect authorization handling (CWE-863) in Google Chrome before 154.0.8037.57 allows remote, unauthenticated attackers to bypass intended authorization checks by convincing a user to load attacker-controlled web content, resulting in high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Because exploitation hinges on the UI:R component, it is not a fully drive-by condition - the victim must visit a malicious or compromised page while running an unpatched build, and the requirement for that user action is the main limiting factor. Exploitation status at time of analysis is that no public exploit code has been identified, and CISA KEV does not list this CVE; EPSS is low at 0.22% (12th percentile), suggesting limited observed exploitation pressure despite the high base score. Vendor-released patch: 154.0.8037.57.
Earlier versions of this analysis (1)
CVE-2026-95314 is recorded against Ubuntu Linux based solely on vendor attribution in the supplied intelligence feed, which identifies Ubuntu as the reporting source but provides no vulnerability description, no affected package or version range, no CVSS score or vector, and no CWE classification. Because the impact, attack vector, and prerequisite conditions are entirely unspecified, risk cannot be meaningfully assessed from the provided data, and no public exploit code has been identified at time of analysis. Treat this record as an unenriched vendor attribution that requires follow-up against Ubuntu's own security notices and CVE tracker before any exposure determination is made.
RemediationAI
Upgrade Google Chrome to 154.0.8037.57 or later - this is the vendor-released patch and removes the exposure entirely; the fix is published in the Chrome Releases stable channel update at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, with technical detail tracked at https://issues.chromium.org/issues/517802696. Administrators should force-apply the update through their managed browser policies (Chrome Enterprise auto-update / relaunch enforcement) rather than relying on users to restart, and should verify the running version reports 154.0.8037.57 or above. On Ubuntu and other distributions that repackage Chromium, apply the corresponding distro update once the Ubuntu security team ships the rebased build, since the upstream Chrome version listed here is the reference point for that package. If immediate upgrade is not possible, the effective compensating control is to constrain the exposure window: block or tightly filter browsing to untrusted external web content for the affected user population and enforce strict script/extension and site-isolation policies, but be aware these are only partial mitigations - they reduce the chance a user reaches a triggering page without removing the underlying authorization flaw, and they carry real usability costs. Disabling JavaScript wholesale is a stronger break-glass option that neutralizes most page-based authorization-bypass paths but breaks the majority of modern web applications and is not sustainable for general users. Given EPSS of 0.22% (12th percentile) and no public exploit code or CISA KEV listing at time of analysis, patching remains the proportionate response; no compensating control should be treated as a substitute for reaching 154.0.8037.57. Monitor the Chromium issue and the vendor advisory for any revision to the affected version range, and re-check EPSS/KEV status if exploitation activity emerges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authorization/access-control defect classified as CWE-863 (Incorrect Authorization), meaning the browser enforces a permission or origin/privilege boundary incorrectly and lets content or a renderer process act beyond the authorization it should have. It sits in the Chromium browser stack that Google ships as Chrome, with CPE and EUVD data identifying the affected product line as Chrome versions earlier than 154.0.8037.57. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates the vulnerability is network reachable, requires no privileges or credentials from the attacker, is straightforward to trigger, and stays within a single security scope, while confidentiality and integrity of data the browser can reach are both rated High; availability is explicitly not impacted, so denial-of-service is not a realistic outcome of exploitation. The UI:R element is the decisive control point: the affected code path is reached only when a user interacts with attacker-supplied web content, which is consistent with a page-based authorization bypass rather than a memory-corruption or silently triggered flaw. Chromium's multi-process architecture and origin isolation assumptions make authorization bugs in this class serious, because a successful bypass can defeat the boundary the browser is supposed to maintain between untrusted web content and the user's data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Browser authorization bypass triggered by visiting a malicious page: remote and unauthenticated (AV:N/PR:N) but needs user interaction (UI:R); C:H/I:H with no availability impact (A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome versions prior to 154.0.8037.57 contain an authorization bypass that could allow attackers to compromise sensitive data and manipulate trusted content when users visit malicious pages. While no public exploit identified at time of analysis, the widespread use of Chrome means a successful attack could lead to data breaches and integrity issues across the organization. Leadership should prioritize patching to mitigate potential confidentiality and integrity risks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB