EUVD-2026-89211
GHSA-5c74-fmf8-h398
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled page
-
DeliveryMalicious content processed by Chrome
-
ExploitTrigger heap buffer overflow
-
ExecutionCorrupt heap and hijack control flow
-
PersistExecute code / escape sandbox (scope change)
-
ImpactCompromise browser and host data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Google Chrome (UI:R - visiting a malicious page or interacting with malicious embedded content such as a page, iframe, or ad). No authentication is required (PR:N) and the attack is remote (AV:N) with low complexity (AC:L). The primary limiting factor is the required user interaction of navigating to or rendering hostile content; the fix is delivered by updating Chrome to the patched Sept 2026 stable desktop release, so unpatched, actively-browsing endpoints are the realistic exposure. The exact triggering feature/component is not specified because the CVE description is unavailable. |
| Impact | This is a genuine high priority. The CVSS 9.6 is driven by a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) heap overflow (CWE-122) in Google Chrome that produces a scope change (S:C) with full C:H/I:H/A:H impact - the classic browser-renderer-to-RCE/sandbox-escape profile. The only mitigating base-metric is UI:R (the victim must visit or interact with attacker content), which is trivially satisfied for a web browser. No EPSS score, KEV listing, or public POC was provided, so there is NO evidence of active exploitation or weaponization at this time; the severity rests on impact and reachability, not on observed attacks. One data conflict to flag: the description is UNKNOWN/[Unknown description], so the specific vulnerable component (renderer, GPU, V8, etc.) cannot be confirmed - the CWE-122 heap overflow and 9.6 vector are the only technical anchors, corroborated by the Chrome release blog and chromium issue 551573368. Given Chrome's ubiquity and its history of these bugs being rapidly reverse-engineered from patches, defenders should treat this as urgent-patch despite the absence of a current POC/KEV signal. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) that triggers a heap buffer overflow in Chrome when the victim browses to it. Successful exploitation corrupts heap memory to achieve arbitrary code execution, and the scope change (S:C) indicates the impact can escape the originally-vulnerable component into the broader browser/host context. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Heap-based buffer overflow in Google Chrome desktop (stable channel) allows a remote, unauthenticated attacker to corrupt heap memory when a victim renders attacker-controlled web content such as a malicious page, iframe, or ad, yielding high impact to confidentiality, integrity, and availability with a changed scope that suggests effects can extend beyond the initially affected component. Exploitation requires user interaction (UI:R) - the victim must load the hostile content - but needs no credentials (PR:N), is network-reachable (AV:N) and low complexity (AC:L), making actively browsing, unpatched endpoints the realistic exposure. No public exploit has been identified at time of analysis; the referenced Chrome stable channel advisory and Chromium issue 551573368 confirm a vendor fix, and the independent assessment rates this a genuine high priority at CVSS 9.6.
Earlier versions of this analysis (1)
Risk cannot be quantified from the available signals because the core metadata is absent: there is no CVSS base score or vector, no CWE, no EPSS probability, no SSVC decision data, and no CISA KEV listing for CVE-2026-95350. What is confirmed is that the affected product is Google Chrome on the desktop stable channel and that the vendor has published a stable-channel update addressing it (referenced via the Chrome Releases blog and reported to intelligence sources by vendor:ubuntu). No public exploit code has been identified at time of analysis, and the specific impact, attack vector, privileges required, and user-interaction requirements cannot be determined from the provided data; exposure is effectively bounded to hosts that have not yet applied the Chrome auto-update.
RemediationAI
Patch available per vendor advisory: update Google Chrome to the fixed release published in the September 2026 stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, then fully restart the browser so the new binary is loaded - an exact fixed version string is not provided in the available data and should be read from the advisory. Ubuntu-packaged deployments should apply the corresponding distro update and confirm the resulting binary version. Where immediate patching is not feasible, compensating controls carry real trade-offs: enforce browser auto-update via enterprise policy and verify the running version (chrome://version), accepting that this only helps on managed endpoints; confine browsing of untrusted or high-risk content to a disposable VM or isolated remote-browsing environment, which reduces the blast radius but adds latency and management overhead; and restrict unpatched browsers from accessing sensitive internal applications and credential stores at the network/identity layer, which limits post-exploitation value at the cost of user convenience. Because this is a memory-corruption bug with a changed-scope vector, rely on Chrome's process isolation and keep the sandbox enabled - disabling it to troubleshoot would materially worsen exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-122 (heap-based buffer overflow), a memory-safety class in which a heap-allocated buffer is written or read past its intended bounds because of missing or incorrect length validation, typically producing memory corruption that can be steered toward code execution or at minimum a reliable crash. In a browser context this class of bug lives in the parsing, rendering, media, or JavaScript-engine layers that process untrusted web content, and the CVSS vector's S:C (scope changed) indicates the impact can cross a security boundary beyond the vulnerable component itself - relevant to Chrome's multi-process, sandboxed architecture where a renderer compromise is only the first stage. The vector AV:N/AC:L/PR:N/UI:R describes a remote, low-complexity attack requiring no privileges but succeeding only when the victim loads attacker-controlled content. The exact triggering feature or component is not specified because the CVE description is unavailable; Chromium issue 551573368 and the September 2026 stable channel advisory are the authoritative sources for the patched component. The deploying distribution flagged by the reporter (vendor:ubuntu) indicates downstream Linux packaging is also tracked for this CVE.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote malicious page (AV:N/AC:L/PR:N) needs only the user to browse (UI:R); a heap-overflow RCE that escapes the renderer sandbox yields S:C and full C/I/A:H.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
A critical memory-corruption vulnerability in Google Chrome desktop exposes any employee who browses the web on an unpatched machine to potential full endpoint compromise, triggered simply by loading attacker-controlled content such as a malicious page, iframe, or advertisement - no credentials are required. Because Chrome is the default browser for most of the workforce and the flaw's changed scope means effects can extend beyond the browser process itself, a successful attack could lead to loss of sensitive data, disruption of business operations, and broader host compromise. A vendor fix is already available, so the organization's real exposure is the deployment gap between patch release and fleet-wide update.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB