EUVD-2026-89149
GHSA-44rx-59qg-xqpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted content to Chrome
-
ExecutionTrigger flaw in browser processing
-
ImpactImpact within browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be enumerated with specificity because the CVE has no description, CVSS vector, or CWE. Based only on product identity, this is a Google Chrome desktop stable-channel fix, so exploitation most plausibly requires the victim to run an affected (unpatched) Chrome desktop version and interact with attacker-controlled web content - but required user interaction, privilege level, and any configuration prerequisites are NOT confirmable from the provided data. Limiting factor: a vendor patch is already available, so exposure is confined to unpatched installations. |
| Impact | Real-world risk cannot be quantified from the provided signals because the core analytical inputs are absent: there is no description, no CVSS base score or vector, and no CWE. Exploitation-probability signals are all silent - no EPSS score, no CISA KEV listing, and no public POC referenced. The one substantive signal is provenance: the sole reference is Google's 'Stable Channel Update for Desktop' blog (Sep 2026) and a vendor patch is available, which confirms this is a Google Chrome desktop stable-channel fix rather than an unrelated product. Chrome's ubiquity means ANY genuine renderer/browser flaw in this channel warrants prompt patching regardless of the missing scoring, and Chrome bugs disclosed via stable-channel posts are historically browser-exploitable (typically requiring the victim to visit a malicious page). However, with no description the specific severity, vulnerability class, and whether user interaction is required cannot be established. CONFLICTING/MISSING DATA: CVSS is entirely absent so attack vector, complexity, and privilege requirements are unverifiable from the input; exploitation status is unknown - verify severity and details against the Chrome Releases blog and NVD once populated. Treat as 'patch-on-normal-Chrome-cadence' priority pending an official severity rating. |
| Exploit ScenarioDerived | Consistent with the Chrome stable-channel patch class, a likely scenario is a victim navigating a Chrome desktop browser to an attacker-controlled or compromised web page that triggers the flaw in the browser's rendering or processing pipeline. No public exploit code is identified at time of analysis, and the specific mechanism cannot be confirmed because the CVE has no description. Actual attack vector and complexity are unverifiable from the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop (stable channel) installations are affected by CVE-2026-95327, a security defect for which Google has published a stable-channel update and a patch is available from the vendor. Because no description, CVSS score or vector, or CWE was supplied with this CVE, the precise impact, attack vector, and affected version range cannot be established from the available intelligence; the only concrete signal is that a vendor fix exists, so residual exposure is confined to unpatched installations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score or CISA KEV entry was provided to indicate elevated real-world risk.
RemediationAI
Patch available per vendor advisory: apply the latest Google Chrome desktop stable-channel update documented in the referenced advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); no exact fixed version string was provided in the input data, so administrators should verify the installed build via chrome://version and confirm it matches or exceeds the release named in that advisory rather than relying on an assumed version number. Ensure Chrome's automatic update mechanism is enabled and not blocked by enterprise policy, and for fleets use the enterprise update controls so that unpatched builds are not pinned; where immediate rollout is not possible, the practical compensating controls are to restrict browsing to trusted internal sites or an allow-listed proxy, which reduces exposure to attacker-controlled web content but degrades usability and does not eliminate the underlying defect, or to run Chrome inside a hardened sandbox/VDI profile with limited local privileges, which constrains post-compromise impact but adds operational overhead. Ubuntu-managed systems should additionally confirm whether the distribution ships its own Chromium/Chrome package and apply the corresponding distribution update, since the vendor attribution in this record indicates downstream packaging involvement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-95327 is tied to Google Chrome's desktop stable release channel, the Chromium-based multi-process browser that relies on renderer sandboxing, site isolation, and a privileged browser process to contain web-content attacks. The provided data contains no CWE classification, no CVSS base score, and no CVSS vector, so the root-cause class (for example memory corruption, type confusion, use-after-free, or an insufficient-validation flaw) cannot be attributed and should not be assumed; Chrome advisories in this channel routinely bundle multiple fixes across the browser and its bundled components, and the referenced stable-channel update blog post is the only technical source supplied. The reporting vendor is listed as ubuntu, which indicates downstream packaging and distribution interest in the upstream Chrome fix rather than a separate Ubuntu-specific vulnerability, and no CPE identifiers were provided to pin an exact product/version tuple. Consequently, this entry should be treated as an unclassified, patch-available browser defect pending the upstream advisory text, and any claim about privilege required, user interaction, or exploitability beyond web-content delivery would exceed the available evidence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB