What is the CVSS score of CVE-2026-95366?

CVE-2026-95366 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95366?

Yes, a patch is available for CVE-2026-95366. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95366

EUVD-2026-89248 MEDIUM

Operation on a Resource after Expiration or Release (CWE-672)

2026-09-23 vendor:ubuntu

GHSA-3rm8-6r4w-v7hc

Information Disclosure Google Suse

Medium

Disputed · 6.5 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Delivery

Serve crafted content to Chrome
Exploit

Trigger browser vulnerability
Execution

Achieve code execution or bypass
Impact

Compromise browser context

Vulnerability Assessment

Weakness	CWE CWE-672 ASVS 5.0 V15 - Secure Coding and Architecture Operation on resource after expiration or release
Exploitation Conditions	Specific prerequisites cannot be extracted because the CVE has no description or CVSS vector. Based only on the confirmed product, exploitation would target the Google Chrome desktop browser at a version prior to the September 2026 stable-channel fix; the linked advisory should be consulted for the exact affected/fixed version. Typical limiting factors for Chrome browser flaws - such as required user interaction (visiting a malicious page) and the renderer sandbox - likely apply but are NOT confirmed here. Defenders should verify the vector, required user interaction, and affected versions directly from the Chrome Releases blog before assessing realistic risk.
Impact	Signal availability is severely limited: there is no NVD description, no CVSS vector or score, and no CWE, so severity and technical impact cannot be independently derived. The only substantive intelligence is the reference to the Google Chrome Releases 'Stable Channel Update for Desktop' blog (September 2026) and a vendor:ubuntu report, which together confirm this is a Google Chrome desktop browser vulnerability fixed in a stable-channel release with a patch available. No EPSS probability, no CISA KEV listing, and no public POC are present. Because Chrome browser bugs are historically among the most valuable exploitation targets (drive-by, renderer/sandbox-escape chains) and Chrome is effectively ubiquitous, the DEFENSIVE priority is to apply the vendor patch promptly regardless of the missing scoring - a fix shipped in a stable-channel security update should be treated as important by default. However, without a description or CVSS it is impossible to confirm exploitability, attack vector, or whether user interaction is required; these MUST be verified against the Chrome release notes. STATED EXPLICITLY: severity, attack vector, privileges, and vuln class are all UNKNOWN from the provided data - do not treat any inferred severity as confirmed.
Exploit ScenarioDerived	Based on the typical shape of Chrome desktop stable-channel security fixes, a likely scenario is a user browsing to an attacker-controlled or compromised web page whose crafted content triggers a flaw in the browser (e.g., renderer memory corruption or a logic bug), potentially leading to code execution in the renderer or a security-boundary bypass. This is unconfirmed: no description or CVSS is available to establish the vector, and no public POC is identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome on desktop is the confirmed affected product, with the fix delivered through the September 2026 stable-channel update documented on the Chrome Releases blog, yet the underlying flaw cannot be characterized from the available record because no description, CVSS vector, or CWE was provided. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS signal was supplied, so no public exploit identified at time of analysis. Because the affected component, version range, and any required user interaction or sandbox-escaping prerequisites are unknown, severity remains unquantified and defenders should treat the vendor advisory as the authoritative source rather than inferring impact from this entry.

RemediationAI

Update Google Chrome desktop to the build identified in the September 2026 stable-channel advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html - patch availability is confirmed per vendor advisory, but no exact fix version string was included in the supplied data, so the build number must be taken from that post. In practice, allow Chrome's built-in updater to apply the release and then fully restart the browser (an updated binary is not active until every Chrome process exits), or force it via chrome://settings/help; enterprise administrators can require an updated version and prompt the relaunch using Chrome Browser Cloud Management or the on-premises policy templates, with the trade-off that a forced relaunch discards open tabs and unsaved form state. Because the record carries no KEV listing, no public exploit code, and no EPSS score, no emergency compensating control is specifically indicated; if the advisory later reveals the flaw is exploitable via a rendered page, the proportionate interim measure is to restrict browsing to trusted origins, which carries a significant usability cost and is not a substitute for patching. If the advisory identifies a discrete feature or service as the attack surface, disabling that feature through enterprise policy may serve as a temporary workaround, but such policies typically degrade functionality and should be removed once the updated build is deployed everywhere, including any extended-stable or LTS ring that has not yet received the fix.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This record supplies no CWE, no CVSS vector, and no component-level detail, so the root-cause class cannot be assigned - the only firm technical anchor is that the affected code ships in Google Chrome's desktop browser and was remediated in a stable-channel release rather than a beta, dev, or extended-stable channel. Chromium-based browsers are multi-process: web content renders inside a sandboxed renderer, sites are partitioned by Site Isolation, and memory-safety bugs (the dominant class in this codebase historically) typically require an attacker to first obtain renderer code execution and then chain a separate sandbox escape to reach the host OS. The Chrome Releases advisory is the only reference provided and should be consulted to identify the exact component (for example Blink, V8, Skia, or a graphics/network service), the precise affected and fixed build numbers, and whether user interaction such as visiting a crafted page is a precondition. Note that the 'reported by' attribution to Ubuntu reflects the coordination/reporting channel for the CVE record, not evidence that the flaw is Linux-specific; the same Chromium build underlies Chrome on Windows and macOS. No CPE strings were supplied, so no exact product/version fingerprint can be asserted beyond desktop Chrome on the stable channel.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Sep 30, 2026 - 20:53 NVD

6.5 (MEDIUM)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant desktop browser across virtually all environments

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.