What is the CVSS score of CVE-2026-95364?

CVE-2026-95364 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95364?

Yes, a patch is available for CVE-2026-95364. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95364

EUVD-2026-89169 MEDIUM

Improper Input Validation (CWE-20)

2026-09-23 vendor:ubuntu

GHSA-mhj5-523m-wj8v

Information Disclosure Google Suse

Medium

Disputed · 5.4 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Exploit

Serve crafted content to Chrome
Execution

Trigger flaw in browser code path
Impact

Impact within browser context

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Affected product is the Google Chrome desktop browser (stable channel), patched in the September 2026 stable-channel update. The precise prerequisites cannot be stated because no description, CVSS vector, or CWE is provided; typical Chrome stable-channel security fixes require the victim to load attacker-controlled web content, but this specific condition is not confirmed by the available data. Limiting factor: Chrome's built-in automatic update mechanism means many installations will receive the fix without manual action, reducing the realistic exposure window; authentication requirements and user-interaction needs cannot be confirmed from available data.
Impact	Signal availability is severely limited: no NVD description, no CVSS base score or vector, and no CWE are provided, so severity cannot be independently graded. EPSS is absent and there is no CISA KEV listing or public POC, so exploitation status is 'no public exploit identified at time of analysis.' The single reference is the Google Chrome Releases 'Stable Channel Update for Desktop' blog (Sep 2026), which confirms this is a Chrome browser desktop vulnerability fixed in a stable-channel release. Chrome's ubiquity and its position as a primary internet-facing attack surface mean any browser flaw warrants prompt patching even without scoring detail; however, with no severity data, no exploitation evidence, and no technical class identified, this presents as a routine patch-and-move-on item rather than a confirmed emergency. This should be prioritized by patch hygiene (auto-update coverage), not by any confirmed active-exploitation signal, which is absent. CVSS/CWE gaps must be resolved from the Chrome release notes or the corresponding Chromium bug entry before any firm severity judgment.
Exploit ScenarioDerived	Because Chrome vulnerabilities in stable-channel security updates are typically triggered by rendering attacker-controlled web content, a plausible scenario is a user browsing to a malicious or compromised web page that exercises the flawed browser code path. No public exploit code has been identified for this CVE, and the specific vulnerability class is not disclosed in the available data, so the concrete trigger cannot be confirmed.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Unspecified security defects in the Google Chrome desktop browser (stable channel) are addressed by the September 2026 stable-channel update, which is the only substantive technical anchor available for CVE-2026-95364. Affected parties are organizations and users running pre-update Chrome desktop stable builds, including Ubuntu-packaged deployments given that the issue was reported by vendor:ubuntu; the vulnerability class, attack vector, and authentication requirements cannot be confirmed because no description, CVSS vector, or CWE was supplied. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; EPSS and NVD data are unavailable, so severity cannot be independently graded.

RemediationAI

Apply the vendor's September 2026 stable-channel update for Google Chrome - patch status is 'Patch available per vendor advisory' per the Chrome Releases notice at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; no exact fix version string was provided in the input data, so verify the installed build against that advisory rather than assuming a version number. Confirm Chrome's built-in automatic update mechanism is enabled and not blocked by enterprise policies or update-server firewalls, since auto-update is the primary reason the realistic exposure window is short; audit managed fleets with an inventory or EDR query to find endpoints still on pre-update builds. For Ubuntu-packaged installations, subscribe to vendor:ubuntu security notices and apply the corresponding package update once published, and note that distro rebuilds can lag the upstream Chrome fix. Because the vulnerability class is unknown, no feature-specific workaround (such as disabling a flag, blocking a port, or restricting an endpoint) can be honestly recommended; the only defensible interim compensating control is to reduce use of the unpatched browser for untrusted web content - for example, routing high-risk browsing through a managed, already-updated alternative or an isolated/remote browsing environment - at the cost of workflow disruption and additional infrastructure overhead. Do not treat third-party 'patch unavailable' claims as authoritative: the absence of detail in this record is a data gap, not confirmation that no fix exists.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The single authoritative reference for this record is the Google Chrome Releases stable-channel advisory, which is a cumulative release note covering multiple fixes rather than a vulnerability-specific writeup. Because no NVD description, CWE, or CVSS vector accompanies CVE-2026-95364, the root-cause class - memory corruption, type confusion, use-after-free, sandbox escape, or an engine-level logic flaw - cannot be determined from the available data, and no CPE strings were provided to pin the affected component or platform beyond the desktop stable channel. Chrome packages the Blink rendering engine, the V8 JavaScript engine, and a multi-process sandbox, and the stable channel is the default consumer/enterprise update track; historically, defects fixed on this channel become exploitable through rendering of attacker-controlled web content, but that prerequisite is not confirmed for this specific CVE. The reporter attribution to vendor:ubuntu suggests the downstream Ubuntu build of the browser may also require coordinated updates.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 19:22 NVD

5.4 (MEDIUM)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Ubiquitous

Google Chrome is among the most widely deployed desktop browsers worldwide

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +27

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.