What is the CVSS score of CVE-2026-95331?

CVE-2026-95331 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95331?

Yes, a patch is available for CVE-2026-95331. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95331

EUVD-2026-89251 CRITICAL

Out-of-bounds Write (CWE-787)

2026-09-23 vendor:ubuntu

GHSA-8pjp-qxrq-28v8

Buffer Overflow Google Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure user to malicious web page
Exploit

Serve crafted web content
Execution

Trigger undisclosed Chrome flaw
Impact

Impact (unconfirmed from data)

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exact preconditions are not disclosed in the available data (no description or CVSS vector). Based on the Chrome desktop stable-channel context, exploitation most plausibly requires the victim to run an unpatched Chrome desktop build and to load attacker-influenced web content, implying user interaction (browsing) as a limiting factor; authentication requirements cannot be confirmed from available data. The primary limiting factor is that a fixed stable-channel build is already available, so only outdated installations remain exposed. Specific feature, configuration, or platform prerequisites are UNKNOWN pending Google's detailed advisory.
Impact	Signal availability is extremely limited: no CVSS score/vector, no CWE, no EPSS probability, no CISA KEV listing, and no public POC are present in the input, so no quantitative risk framework (CVSS severity, EPSS exploitation probability, SSVC automatable/technical-impact) can be applied. The only concrete signals are the reference to the Chrome Releases 'Stable Channel Update for Desktop' blog (September 2026) and 'patch available from vendor', which together strongly indicate this is a Google Chrome desktop stable-channel security fix that has already been remediated upstream. Because Chrome is a browser-class, ubiquitously deployed target, browser vulnerabilities in this family are historically valuable and sometimes exploited, but there is NO evidence of active exploitation here - KEV is not set and no POC is referenced. Net assessment: treat as a routine-but-important browser patch to deploy promptly given Chrome's footprint, NOT a confirmed emergency; the risk ranking is currently indeterminate because the vulnerability class, attack vector, and impact are all UNKNOWN from the provided data. Verify details against the linked Chrome Releases advisory once Google discloses the specific bug entry.
Exploit ScenarioDerived	Consistent with the Chrome stable-channel patch pattern, a realistic scenario is a user browsing to an attacker-controlled or compromised web page that triggers the underlying flaw in the browser, though the exact vulnerable component and outcome are not disclosed in the available data. No public exploit code or proof-of-concept is referenced. The specific attack vector and complexity cannot be confirmed because no CVSS vector or description was provided.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Unspecified security defects in Google Chrome desktop builds are addressed by a September 2026 stable-channel update, meaning only users running outdated installations remain exposed. The exact vulnerability class, attack vector, and privilege requirements are not disclosed in the available data, so the primary applicability condition is simply that the victim runs an unpatched Chrome desktop build and loads attacker-influenced web content, which implies user interaction (browsing) as a limiting factor. There is no CVSS score or vector, no CWE mapping, no EPSS probability, no CISA KEV listing, and no public exploit code identified at time of analysis, so no quantitative severity or exploitation-probability framework can be applied to this record.

RemediationAI

Upgrade Google Chrome desktop to the fixed stable-channel build published in the referenced Chrome Releases advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); the advisory is the authoritative source for the exact fixed version, which is not specified in the provided input, so the applicable rule is patch status "Patch available per vendor advisory" rather than a confirmed version string. Chrome's built-in updater normally applies the fix automatically, but browsers that are pinned, sideloaded, or blocked from update services will not receive it, so verify the installed version after relaunching the browser, since the update only takes effect after a full restart of all browser processes. Ubuntu users tracking the vendor:ubuntu report should apply the matching chromium/chrome package update from their distribution channel rather than relying on a separately installed upstream build, to avoid version drift between the two. Until the update is confirmed installed, compensating controls are limited because the affected feature is unknown: restricting browsing to trusted origins or isolating Chrome in a sandboxed or disposable environment reduces exposure but breaks normal web workflows, disabling JavaScript or plugins is highly disruptive and may not address the flaw, and network-level filtering cannot be tuned without knowing the trigger. The most reliable interim control is to enforce the vendor update through managed-browser policy and confirm compliance by version inventory.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This record points to a Google Chrome Releases stable-channel update rather than to an independently described flaw, and it carries no description, no CWE, and no CPE strings, so the underlying component, root-cause class, and precise affected build cannot be determined from the supplied intelligence. What can be established structurally is the Chrome desktop release model: Google accumulates security fixes internally and ships them in stable-channel builds, publishing the advisory concurrently so that most users are auto-updated before technical detail becomes widely circulated; the linked Chrome Releases post is the authoritative source for the fixed build number and any associated reward or bug identifiers. The absence of a CWE prevents classification of the weakness class (for example memory-safety, type confusion, or logic error) and therefore prevents reasoning about exploitability from the root cause. Similarly, the absence of CPE data means affected-platform enumeration must rely on the vendor advisory rather than on normalized product identifiers. The record is tracked by the Ubuntu vendor (vendor:ubuntu), which indicates a downstream distribution maintainer is monitoring or packaging the corresponding fix for its Chrome/Chromium channel, and any Ubuntu-specific advisory should be treated as a secondary reference to the same upstream correction.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.5%

Top 62% exploitable

Prevalence

Ubiquitous

Google Chrome desktop - dominant browser across consumer and enterprise environments

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.