EUVD-2026-89212
GHSA-wh2x-cjpp-89mh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted content to Chrome
-
ExploitTrigger out-of-bounds write in browser
-
ExecutionCorrupt memory / hijack control flow
-
ImpactExecute attacker code beyond renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open attacker-controlled web content in a vulnerable version of Google Chrome (UI:R - the user must visit or load the malicious page); no authentication and no special non-default configuration is needed (PR:N, AC:L), and exploitation works remotely over the network against a standard Chrome desktop install. The limiting factor is the required user interaction (loading a page) and the need for the target to be running an unpatched Chrome build predating the September 2026 stable-channel fix; exact affected versions are unconfirmed in the provided data and must be checked against the Chrome release advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a critical, network-reachable, low-complexity, unauthenticated memory-corruption flaw whose scope change (S:C) is consistent with a renderer-process compromise crossing the Chrome sandbox/process boundary - the classic profile of a browser 'visit-a-malicious-page' RCE. EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit is referenced, so despite the high base score there is no evidence of active exploitation or public exploit code at time of analysis; the realistic priority derives from the product's ubiquity plus the high historical exploitability of Chrome OOB-write bugs rather than from any confirmed in-the-wild signal. Two caveats to verify: the underlying description is '[Unknown description]', so the exact vulnerable component, affected version range, and fixed version are NOT confirmed from the input and must be pulled from the Chrome releases blog and chromium issue 530045332; and CWE-787 (out-of-bounds write) with C:H/I:H/A:H and S:C is fully coherent with the 'Buffer Overflow / Memory Corruption' tags, so no metric conflict is present, only missing detail. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted content that triggers the out-of-bounds write when rendered by Chrome; a victim need only visit the page (UI:R) with a vulnerable browser. The memory corruption combined with the scope change (S:C) can allow code execution in the renderer and potentially escape toward broader impact. No public proof-of-concept or active exploitation is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Out-of-bounds memory write in Google Chrome allows remote attackers to corrupt memory in a victim's browser by having them load attacker-controlled web content, rated CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No authentication or non-default configuration is required, but exploitation depends on user interaction (the victim must visit or load the malicious page) and on running an unpatched build predating the September 2026 stable-channel fix; exact affected versions are not confirmed in the available data. The scope-change component suggests impact extending beyond the initially affected component - the classic profile of a renderer-process compromise crossing Chrome's process boundary - and while a vendor patch is available, no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Earlier versions of this analysis (1)
Google Chrome desktop stable channel users are exposed to an unspecified security weakness that the vendor addressed in a Stable Channel update published on the Chrome Releases blog, while the fixed build number, affected version range, and flaw class remain undisclosed in the available intelligence. Because no CVSS vector, CWE, EPSS probability, or CPE data accompanies this record, impact cannot be characterized beyond product-level scope, and exploitation would realistically require a user to run an unpatched Chrome build and interact with attacker-controlled web content - an inference from product type rather than a stated condition. No public exploit has been identified at time of analysis, and there is no KEV confirmation of active exploitation, so risk cannot be quantitatively assessed from the supplied signals.
RemediationAI
Vendor patch is available per the Chrome stable-channel advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; apply it by allowing Chrome to auto-update to the fixed build and verifying the version via chrome://version (or the About Chrome menu), then restart the browser so the new binary is loaded. Ubuntu and other downstream Chromium users should update their packaged Chromium through the normal channel (apt/snap refresh) once the distribution carries the upstream fix, since distro builds lag the Chrome stable release. No vendor-released patch version string is given in the source data, so the exact fixed build number should be taken from the advisory rather than assumed. Because exploitation requires the victim to load attacker-controlled web content, interim compensating controls include keeping Site Isolation enabled and not disabling the sandbox (these limit cross-site data exposure and contain renderer compromise but do not prevent the out-of-bounds write itself), restricting browsing to trusted sites and disabling unnecessary or untrusted browser extensions for high-risk users, and for managed fleets applying enterprise update policies that force rapid Chrome version enforcement - all of which carry usability trade-offs and are strictly stopgaps until the patched build is deployed. Note that no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so priority should be driven by the critical severity (CVSS 9.6) and the low-complexity network attack path rather than by observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-787 (Out-of-bounds Write), a memory-safety defect in which a write operation targets memory outside the intended buffer, typically enabling heap or object corruption, controlled memory manipulation, and potentially arbitrary code execution within the compromised process. In Chromium-based browsers such as Google Chrome, web content is parsed and rendered in a sandboxed renderer process, so a memory-corruption primitive in the content-processing path is reachable simply by loading a crafted page - matching the assessed vector's AV:N, AC:L, PR:N and UI:R profile. The CVSS scope change (S:C) indicates the impact crosses a security boundary rather than remaining confined to the vulnerable component, consistent with an attacker operating from a renderer context and interacting with the broader browser security model (process isolation/sandbox), which is why confidentiality, integrity, and availability are all rated High. The referenced Chromium issue tracker entry (issues.chromium.org/issues/530045332) corresponds to the restricted bug that produced the stable-channel fix; the release advisory (chromereleases.googleblog.com, September 2026 stable-channel update) is the authoritative source for the exact affected version range, which is not enumerated in the supplied data.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote malicious-page trigger (AV:N, AC:L, PR:N) with required page load (UI:R); OOB write crossing the renderer sandbox boundary yields S:C and full C/I/A:H.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome contains a critical out-of-bounds memory write (CVE-2026-95357, CVSS 9.6) that a remote, unauthenticated attacker could trigger simply by getting an employee to open attacker-controlled web content; successful exploitation could let an attacker escape the browser's renderer sandbox and reach the underlying operating system. Any workforce member using an unpatched Chrome build on managed or unmanaged endpoints is exposed, and because browsers are the primary business application for most staff, this represents a broad, easily reachable attack surface requiring only a single malicious link or compromised site visit - no public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB