EUVD-2026-89220
GHSA-j4rq-37m4-w856
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconHost malicious web page
-
DeliveryLure victim to visit (UI:R)
-
ExploitTrigger use-after-free in Chrome
-
InstallGroom heap and reclaim freed object
-
C2Execute code in renderer
-
ExecuteEscape sandbox (S:C)
-
ImpactFull system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome to be induced to render attacker-controlled web content (UI:R - visiting a malicious or compromised page, or loading a malicious ad/iframe); no authentication or pre-existing privileges are needed (PR:N). The limiting factor is the required user interaction and the fact that a working exploit must win a heap-grooming race to reclaim the freed object and, per the scope change (S:C), chain to a sandbox escape for full impact. Users on an already-patched Chrome stable build (fix available from vendor) are not exposed; the specific vulnerable component and exact fixed version are not disclosed in the available data. |
| Impact | This is a genuine high priority issue despite the absence of a public description. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) requiring only user interaction (visiting a malicious page) with a scope change to full confidentiality/integrity/availability compromise - the classic renderer-exploit profile for a browser. Chrome is among the most widely deployed software on Earth, which sharply raises real-world exposure. No EPSS score, KEV listing, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; the 9.6 base score reflects worst-case potential impact, not confirmed active exploitation. That said, memory-corruption bugs fixed in Chrome stable channel releases are frequent targets for weaponization once patch diffs are public, and the scope-change RCE potential means defenders should treat patch deployment as urgent. The 'Information Disclosure' tag understates the issue: a scope-changing UAF with C:H/I:H/A:H is a memory-corruption/RCE-class flaw, not merely a disclosure bug. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects a malicious ad/iframe) that triggers the use-after-free in a vulnerable Chrome component when a victim browses to it. The freed-then-reused object is groomed to gain control of memory, enabling code execution in the renderer and, given the scope change (S:C), a path toward sandbox escape and full compromise. No public POC is identified in the provided data, but browser UAF bugs are historically reliable to exploit once the patch is analyzed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Use-after-free memory corruption in Google Chrome's desktop stable channel lets remote, unauthenticated attackers achieve high-integrity/high-availability impact against a victim who simply renders attacker-controlled web content - the attacker must first convince the user to visit a malicious or compromised page (or load a malicious ad/iframe), which is why the assessed vector carries UI:R despite PR:N. Per our independent assessment, a practical exploit must win a heap-grooming race to reclaim the freed object and, because of the scope change (S:C), chain a further sandbox escape to fully realize the 9.6 severity, so exploitation is possible but not trivial. A vendor fix is available in the referenced Chrome stable channel update, and no public exploit code has been identified at time of analysis; the specific vulnerable component and exact fixed build are not disclosed in the available data.
Earlier versions of this analysis (1)
Google Chrome on the desktop stable channel is the subject of CVE-2026-95356, a security fix referenced in Google's Chrome Releases stable-channel update advisory, but no description, CVSS score, or CWE has been published, so the exact component and severity cannot be independently quantified. No public exploit code has been identified at time of analysis and there is no KEV listing or EPSS score for this identifier, so confirmed active exploitation cannot be asserted. Affected users are those running a Chrome stable desktop build older than the version documented in the referenced Chrome Releases advisory; because Chrome flaws are commonly reverse-engineered into exploits shortly after patches ship, treat this as a patch-now item and confirm the fixed build number directly from Google's advisory. The flaw was also reported through the Ubuntu vendor tracking channel, indicating downstream Chromium/Chrome packaging relevance for Ubuntu users alongside the upstream Google fix.
RemediationAI
Vendor-released patch is available: update Google Chrome to the current stable channel build described in the vendor advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html (trigger an in-browser check via chrome://settings/help, or deploy the updated package through managed software distribution); Ubuntu-packaged builds should be upgraded through the distribution's normal channel given the vendor:ubuntu attribution. Until the update is deployed, the highest-value compensating controls are those that break the exploitation chain rather than the trigger: enforce Chrome auto-update and relaunch (mitigation is incomplete if the browser process is only restarted later - the running binary must be the patched one), keep Site Isolation enabled and never disable it for convenience, since it confines renderer compromise and is the main barrier to converting this use-after-free into full S:C impact (trade-off: additional processes and memory overhead, and occasional rendering/interop regressions on unusual sites), and apply enterprise URL allowlisting or content filtering to reduce exposure to untrusted pages and malvertising (trade-off: blocks legitimate content and requires ongoing allowlist maintenance). Avoid relying on disabling JavaScript or extensions as a workaround - it breaks most web applications and does not reliably prevent the freed-object race, and there is no evidence in this dataset that a command-line flag or configuration setting eliminates the defect. No public exploit code has been identified at time of analysis, but because exploitation only requires user interaction and a reliably delivered page, prioritize the upgrade over detection-based controls, and treat the Chromium issue tracker entry (https://issues.chromium.org/issues/560439699) as the reference for confirming patch completeness across dependent Chromium-based browsers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) inside the Chromium codebase shipped in Google Chrome - a memory-safety defect in which an object is freed while a reference to it remains reachable, so a subsequent dereference reads or writes attacker-influenced heap memory. In Chromium's multi-process architecture this typically manifests in a renderer (or GPU/utility) process, where the attacker controls the triggering input through web content; the tags associated with this record (Use After Free, Memory Corruption, Information Disclosure) indicate the freed object can be reallocated with attacker-controlled data, first yielding memory disclosure and then, depending on what the reclaimed object is, corruption that can be escalated to code execution within the compromised process. Because the assessed vector sets S:C, full impact requires escaping the sandbox boundary in addition to winning the heap race, which means the initial primitive alone is not sufficient for the maximum score - the sandbox is the defense that converts a renderer compromise into a contained one. The authoritative references are Google's stable channel release note and the Chromium issue tracker entry, which are the canonical sources for the exact affected and fixed revisions.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered malicious page (AV:N/AC:L/PR:N) needs a victim to load it (UI:R); a renderer UAF that can escape the sandbox is a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome's desktop stable channel carries a critical use-after-free flaw (CVE-2026-95356, CVSS 9.6) that can be triggered when an employee simply browses attacker-controlled web content, making the entire browser-using workforce the exposure surface rather than a narrow server segment. Because a successful attack requires heap-grooming and a follow-on sandbox escape, exploitation is feasible but non-trivial, and no public exploit code has been identified at time of analysis. Leadership should care because Chrome is a ubiquitous, business-critical access point to SaaS, email, and internal applications, so an unpatched browser fleet represents broad, hard-to-contain risk to data integrity and availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB