EUVD-2026-89159
GHSA-rc23-4fv3-pcr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to victim host
-
ExploitTrigger incomplete-cleanup code path in Chrome
-
ExecutionRead uncleared sensitive resource
-
ImpactExfiltrate disclosed data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | Exploitation is bounded by the local attack vector (AV:L): the attacker needs local presence or the ability to execute within the browser/host context on a system running Google Chrome prior to 154.0.8037.57; it is NOT a remote drive-by against a default install despite PR:N/UI:N. The specific feature, configuration, or resource whose cleanup is incomplete cannot be named because the CVE description is unavailable - defenders should consult Chromium issue 533041383. The primary limiting factor is the requirement for local access, which substantially narrows realistic exploitation compared to a network-facing browser flaw, and the fix is already available via the Chrome stable update. |
| Impact | Signals here are mixed and lean toward LOWER real-world urgency than the 8.4 base score suggests. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - notably AV:L (local), meaning exploitation requires local access to the host rather than a drive-by web attack, which is unusual framing for a browser engine bug and worth verifying against the (unavailable) description. EPSS is only 0.25% (15th percentile), indicating very low modeled probability of exploitation in the near term. The CVE is NOT in CISA KEV and no public POC is referenced, so this is no public exploit identified at time of analysis. There is no SSVC decision data provided. The CWE is CWE-459 (Incomplete Cleanup) and the only category tag is 'Information Disclosure', which conflicts with the vector's I:H/A:H (high integrity and availability impact) - an incomplete-cleanup/info-leak issue would more typically be confidentiality-dominant, so the I:H/A:H metrics should be verified with Google/Chromium. Net: a patched, low-EPSS, non-KEV local-vector Chrome bug - routine patch-cycle priority, not an emergency, though Chrome's ubiquity means it should still be rolled out promptly. |
| Exploit ScenarioDerived | With AV:L, an attacker who already has local access or the ability to run code/content in the browser context on the victim host leverages incomplete cleanup of a resource to read sensitive data left in memory or disk from a prior session. Given the 'Information Disclosure' classification, the likely payoff is leaked credentials, tokens, or other process memory rather than full remote takeover. No public proof-of-concept is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.
Earlier versions of this analysis (1)
No security impact can be established for CVE-2026-95326 from the available data: the description is empty, no CVSS score or vector is provided, no CWE is assigned, and no CPE or version information accompanies the record. The only intelligence available is a provenance tag indicating the issue was reported by the vendor source 'ubuntu', which implies the affected component is an Ubuntu-maintained package or image but does not identify which one. No public exploit code has been identified at time of analysis, and exploitability, attack vector, privileges required, and user interaction are all undetermined; treat this record as unresolvable until the upstream advisory, package name, and affected versions are obtained.
RemediationAI
Vendor-released patch: Chrome 154.0.8037.57, distributed through the Chrome stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html. Update Chrome to 154.0.8037.57 or later and restart the browser so the new binary is running; enterprise administrators should force the update through their management console and verify the reported version on endpoints, since merely downloading the update without relaunching leaves the vulnerable process in place. Organizations that cannot immediately patch should treat this as a low-priority local exposure rather than a network emergency and apply compensating controls that reduce the local attack surface: restrict interactive and process-level access to machines running affected Chrome builds, tighten endpoint detection for unusual cross-process reads or data exfiltration from the browser profile, and consider disabling or sandboxing non-essential local extensions and integrations that could act as the local foothold. These measures are palliative only - they do not fix the incomplete cleanup and may degrade usability or break browser-integrated workflows, so the update to 154.0.8037.57 remains the definitive remedy. No workaround in the Chrome advisory replaces the patch, and Chromium issue 533041383 should be consulted for any further vendor guidance once its details are available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-459 (Incomplete Cleanup): some resource, buffer, or artifact handled by Chrome is not fully purged at the end of its lifecycle, so residual sensitive data can be observed by an attacker who already has a foothold on the host. Because the CVE description is unavailable, the specific feature, configuration, or resource involved cannot be named; the authoritative technical detail lives in Chromium issue 533041383 and the Chrome stable channel release notes. The affected surface is the Chrome browser (EUVD lists affected versions as prior to 154.0.8037.57), consistent with the CPE for Google's Chromium/Chrome desktop builds; the reporting credit comes from the Ubuntu vendor channel, which packages and tracks Chromium, so downstream Chromium-based and distro-packaged browsers should be treated as in scope. The attack vector is local (AV:L) with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), which means a process or user already executing in the browser's or host's context can trigger the flaw without a victim clicking anything - but it still cannot be reached across the network. Our assessment scopes the impact to information disclosure only (C:H/I:N/A:N), unlike the vendor base vector, which also asserts high integrity and availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Retained AV:L per input; CWE-459 incomplete-cleanup tagged as Information Disclosure implies confidentiality-only impact, so I and A set to N pending vendor detail.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
A confidentiality flaw in Google Chrome versions prior to 154.0.8037.57 could allow an attacker with local access to an endpoint to read sensitive data that should have been discarded, primarily affecting managed user workstations and high-value devices rather than internet-facing services. Because realistic exploitation requires local presence or code execution within the browser or host context, the practical risk is narrower than the 8.4 base score suggests, and a vendor patch already exists. Leadership should treat this as a routine but time-bound browser remediation item, with urgency driven by the population of unpatched endpoints rather than by any observed exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB