What is the CVSS score of CVE-2026-95346?

CVE-2026-95346 has a contested CVSS base score of 4.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95346?

Yes, a patch is available for CVE-2026-95346. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95346

EUVD-2026-89261 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-09-23 vendor:ubuntu

GHSA-q5jv-j3j2-c2x4

Information Disclosure Google Suse

Medium

Disputed · 4.8 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure user to malicious web page
Exploit

Serve crafted web content
Execution

Trigger undisclosed Chrome flaw
Impact

Achieve unspecified impact in browser context

Vulnerability Assessment

Weakness	CWE CWE-451 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V3 - Web Frontend Security UI security representation
Exploitation Conditions	Cannot be specified - the description is empty and no CVSS vector is provided, so exact prerequisites are unknown. Based on product identity alone, Chrome desktop flaws typically require the victim to browse to attacker-controlled web content (user interaction), but this is an inference, not a stated condition. The mitigating factor is that a vendor patch is already available; defenders should apply the current stable-channel Chrome update. Do not assume remote unauthenticated default-config exploitation without confirmation from the Chrome Releases advisory.
Impact	Risk cannot be quantitatively assessed from the available data: no CVSS base score or vector, no CWE, no EPSS probability, no SSVC decision, and the description is empty. The single authoritative signal is a Chrome Releases 'Stable Channel Update for Desktop' advisory (Sep 2026) plus a vendor-supplied patch, which confirms this is a genuine Google Chrome desktop browser fix rather than a speculative report. Exploitation status is 'no public exploit identified at time of analysis' - it is NOT in CISA KEV and no POC is referenced; do not treat it as actively exploited. Despite the absence of scoring, the affected product is one of the most widely deployed applications in existence, so the population at risk is enormous even if per-instance exploitability is unproven. Net: this is a patch-now hygiene item driven by product ubiquity and vendor confirmation of a fix, NOT by any demonstrated real-world exploitation signal. KEY DATA MISSING - vulnerability class, attack vector, privileges, and impact are all unknown; obtain the specific bug ID/severity from the linked Chrome Releases blog before making a formal severity determination.
Exploit ScenarioDerived	Because the vulnerability class is undisclosed, a concrete scenario cannot be responsibly constructed; for Chrome desktop the typical pattern is a user navigating to a malicious or compromised web page that triggers a flaw in the browser's rendering, JavaScript, or media-handling components. No public proof-of-concept or exploit code is referenced, and there is no evidence of active exploitation. Verify the actual trigger and severity against the Chrome Releases advisory before acting on this scenario.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop users on the stable channel are affected by CVE-2026-95346, a flaw that Google addressed through a Stable Channel Update for Desktop documented on the Chrome Releases blog. The supplied advisory is the only reference, and no description, CVSS score, CWE, or CPE data accompanies this CVE, so the specific vulnerability class, affected build range, and impact cannot be confirmed from the available intelligence; exploitation prerequisites are likewise unconfirmed. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available per the Chrome Releases advisory, so the primary exposure is the window between patch publication and the user restarting the browser. Because the CVSS vector is absent, authentication requirements cannot be confirmed from available data, and remote unauthenticated default-configuration exploitation should not be assumed.

RemediationAI

Patch status for CVE-2026-95346 is patch available per vendor advisory: upgrade Google Chrome on the desktop stable channel to the build published in the Chrome Releases bulletin at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; the exact fixed version number is not specified in the supplied data and should not be assumed, so confirm it against that advisory before validating the update. End users can force the update via chrome://settings/help and must fully relaunch the browser for the fix to take effect, since an un-restarted session continues running the vulnerable binary. Managed fleets should push the update through Google Update / enterprise MSI policies or their macOS/Linux software distribution tooling, and Ubuntu or Chromium users relying on Canonical packaging should refresh the corresponding snap or package once the vendor rebuild lands. If immediate patching is not feasible, compensating controls carry real trade-offs: restricting users to a trusted-site allowlist via URLBlocklist/URLAllowlist or a proxy reduces exposure but breaks general browsing and is high-maintenance; disabling high-risk subsystems such as WebGL, WebRTC, or JIT (via chrome://flags or enterprise policy) shrinks the attack surface for renderer-class bugs but degrades application compatibility and performance; and running untrusted browsing in a separate low-privilege OS account or disposable VM limits post-exploitation impact at the cost of workflow friction. None of these substitutes for applying the vendor update, which is already available.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CVE-2026-95346 is identified only as a Google Chrome desktop stable-channel issue in a Chrome Releases bulletin, with no CWE classification, no CVSS vector, and no CPE strings provided in this dataset, so the root-cause class cannot be stated with confidence. By product identity alone, Chrome desktop flaws surfaced in stable-channel updates commonly reside in the rendering stack (Blink), the V8 JavaScript engine, the GPU/ANGLE layer, WebRTC, or the Mojo IPC boundary, and are frequently paired with a sandbox-escape primitive in a second bug; however, this is a pattern inference and not a stated property of this CVE. Chrome's defenses relevant to whatever class this bug belongs to include the multi-process site-isolated sandbox, the V8 heap sandbox, and increasingly strict process mitigations on Windows and macOS, all of which raise the cost of turning a renderer compromise into full host compromise. The 'reported by vendor:ubuntu' attribution indicates Canonical tracked the upstream fix for its distributed Chrome/Chromium packaging, consistent with a defect that landed in Google's own stable update rather than in a downstream-only patch. Exact affected builds and platforms must be read from the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

SUSE CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 19:22 NVD

4.8 (MEDIUM)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant desktop web browser worldwide

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +24

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.