EUVD-2026-89117
GHSA-x3x3-hf7p-wvv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted content to Chrome
-
ExecutionTrigger browser vulnerability
-
ImpactAchieve unspecified in-browser impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Exploitation conditions cannot be enumerated precisely because no description or CVSS vector is provided. Based on product identity, the affected component is Google Chrome desktop (stable channel) and the flaw is reachable through the browser's normal handling of web content; the primary limiting factor is that the victim must run an unpatched Chrome build and typically must be induced to load attacker-controlled content (user interaction likely required). A fix is already available via the September 2026 stable-channel update, so Chrome's automatic update mechanism substantially limits the exposure window for most deployments. |
| Impact | This CVE has no CVSS score, no CVSS vector, no CWE, and no description in the available data, so severity cannot be independently derived from the input. The only substantive signal is that it appears in the Google Chrome Releases stable-channel-for-desktop advisory (September 2026) with a patch available, which places it within a routine batch of Chrome desktop security fixes (siblings CVE-2026-95327/95328/95329 and the 95344-95357 batch). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no evidence of active or imminent exploitation. The practical risk driver here is prevalence, not confirmed severity: Chrome is ubiquitous, so any browser-engine memory-safety or logic flaw is broadly reachable via malicious web content, and Chrome bugs are historically attractive targets. However, absent a CVSS vector or vulnerability class, exploitability, attack complexity, and impact are UNKNOWN and must not be presented as high. Recommended posture: treat as standard 'patch promptly via Chrome auto-update' hygiene, not a confirmed emergency, and verify the specific severity (Google typically rates these Low/Medium/High/Critical) against the Chrome Releases blog once the per-CVE detail is published. |
| Exploit ScenarioDerived | Because Chrome renders untrusted web content, the realistic scenario is a user with an unpatched Chrome desktop build visiting an attacker-controlled or compromised web page that triggers the flaw within the browser process. The concrete impact (memory corruption, sandbox escape, information disclosure, or logic bypass) cannot be stated because no description or vulnerability class is provided. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop (stable channel) builds predating the September 2026 stable-channel update carry a flaw that the vendor has already fixed, but the available intelligence contains no description, CWE, or CVSS vector, so the precise impact cannot be characterized from the supplied data. The affected component is the Google Chrome stable desktop browser, and exploitation would require the victim to run an unpatched build and, in most realistic scenarios, to load attacker-controlled web content, meaning user interaction is likely a prerequisite. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided to quantify exploitation likelihood; the principal mitigating factor is that the fix is already shipping through Chrome's automatic update mechanism, which sharply limits the exposure window for most managed and consumer deployments.
RemediationAI
Patch status is patch available per vendor advisory, so the primary action is to apply the September 2026 stable-channel Chrome update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; this is the only concrete fix artifact in the dataset and no exact fix version string was disclosed, so verify the installed build through chrome://settings/help or the equivalent about page rather than asserting a version number. Because Chrome's automatic update mechanism normally applies stable-channel fixes without user action, confirm that auto-update has not been disabled by policy, that the browser has actually restarted after downloading the update, and that Linux deployments pull the refreshed distro package given the vendor:ubuntu report. For hosts where immediate update is genuinely infeasible, the compensating controls are restrictive and carry real trade-offs: confine browsing to a hardened, non-persistent profile or a disposable virtual machine, which breaks normal user workflow and bookmark/session continuity; enforce an allowlist of trusted destinations at the proxy or DNS layer, which will block legitimate sites and is brittle to maintain; or restrict the affected deployment to kiosk-style use against a fixed internal application set, which removes general-purpose browsing entirely. Network-level port blocking is not an effective mitigation here because the flaw is reached through ordinary web content rather than a distinct listening service, and no patch-absent vendor workaround was described. Given the absence of a description, CWE, and CVSS score, treat severity as unquantified and prioritize patching on internet-facing and high-privilege user endpoints first, since user interaction with attacker-controlled content is the most likely delivery path and a fix is already generally available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No CWE is supplied, so the root-cause class cannot be assigned from the input data; the only structural signal is the product identity, which points to Google Chrome's desktop stable channel and to a defect reachable through the browser's ordinary rendering and content-processing pipeline. Because Chrome processes untrusted web content by design, flaws of this kind are typically triggered by parsing or executing attacker-supplied markup, script, or media, and the practical control point is the browser version installed on the endpoint rather than any network-reachable service. The single reference is the Chrome Releases blog advisory for the September 2026 stable-channel update, which is the authoritative vendor channel and typically aggregates multiple fixed issues without itemized technical detail until the majority of the user base has updated. No CPE strings were included in the feed, so exact affected build numbers cannot be enumerated beyond the stable channel generally, and no CVSS vector was provided, meaning authentication and privilege prerequisites must be treated as not confirmed from available data rather than assumed to be either authenticated or unauthenticated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB