EUVD-2026-89155
GHSA-f644-w33f-p9hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious web page
-
ExploitServe crafted content to Chrome
-
ExecutionTrigger patched browser-engine defect
-
ImpactImpact depends on undisclosed vuln class
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be enumerated from the provided data - the description, CVSS vector, and CWE are all absent, so no exact feature, protocol, or configuration prerequisite is known. The only established fact is that the affected product is Google Chrome desktop (stable channel) and a vendor patch exists; whether exploitation requires user interaction (visiting a malicious page), a specific Chrome component, or a non-default setting cannot be determined without the Chrome release notes. Limiting factor to verify: Chrome browser flaws typically require the victim to load attacker-controlled web content rather than being remotely reachable without interaction. |
| Impact | This CVE has almost no analyzable signal beyond product identity: no description, no CVSS score or vector, no CWE, no EPSS probability, no KEV listing, and no public POC. The single reference is the Google Chrome Releases 'Stable Channel Update for Desktop' blog (September 2026), and 'reported by vendor:ubuntu' plus 'patch available' confirm this is a Google Chrome desktop stable-channel fix rolled into a broad batch (siblings CVE-2026-95344 through 95366). Because the vulnerability class is undisclosed, real-world risk cannot be quantified from the provided data - Chrome browser bugs frequently reach CVSS High (renderer memory-corruption / sandbox escape typically require the user to visit a malicious page, i.e. UI:R), but that is a class-based prior, NOT a confirmed fact for this ID. Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV entry and no POC. Given Chrome's near-universal deployment and the vendor's own patch, standard practice is to prioritize patching regardless of the missing scoring; however, the missing CVSS/EPSS/KEV means any severity ranking here is provisional. STATED EXPLICITLY: description, CVSS vector, and CWE are all absent - severity and exploitability must be verified against the Chrome release notes / Chromium bug tracker before treating this as a confirmed priority. |
| Exploit ScenarioDerived | Based on the Chrome stable-channel fix pattern (the specific flaw here is undisclosed), a likely scenario is a user with a vulnerable Chrome desktop build browsing to an attacker-controlled web page that triggers the patched defect in the browser engine. No public exploit code or active exploitation is identified for this CVE at time of analysis, and any code-execution or impact assumption is inferred from the product class rather than a disclosed vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop (stable channel) is affected by a vulnerability that is documented only through Google's stable-channel release advisory, with no accompanying description, CVSS score or vector, CWE mapping, EPSS probability, or KEV listing available at time of analysis. Because the technical details of the underlying flaw are absent, the concrete impact on confidentiality, integrity, or availability cannot be characterized, and the only independently confirmed facts are the affected product (Chrome desktop stable) and that a vendor patch exists. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data; as with most Chrome browser issues, the practical limiting factor is that exploitation typically requires the victim to load attacker-controlled web content rather than being reachable without interaction. Organizations should treat this as a patch-management item and apply the current stable-channel update rather than as an immediate emergency, while acknowledging that the risk assessment is based on very limited signal.
RemediationAI
A vendor patch is available per Google's advisory; the primary action is to update Chrome desktop to the current stable-channel release named in the referenced Chrome release notes and to confirm the installed build via chrome://settings/help or the equivalent version check. Note that no exact fix version string is present in the supplied data, so the specific build number must be read from the advisory rather than assumed. Because the defect is uncharacterized, there is no feature to disable or port to block with confidence; the practical compensating controls are to keep Chrome's automatic update mechanism enabled, to use enterprise policy to force browser updates and prevent version pinning on managed fleets, and to delay or restrict high-risk browsing to untrusted sites through content filtering or a managed allowlist until the update is deployed - the trade-off being reduced user flexibility and potential breakage of legitimate web applications. On managed Linux endpoints, coordinate with the distribution vendor's package channel to ensure the corresponding Chromium/Chrome package is refreshed, since distribution packaging may lag the upstream stable release. No workaround specific to the underlying flaw can be recommended because the affected component has not been identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No CWE identifier, CVSS vector, or component-level detail was supplied, so the root-cause class of this flaw cannot be established from the available data. The affected technology stack is the Google Chrome desktop browser on the stable update channel, and the sole reference is Google's stable-channel release advisory, which typically bundles several independent fixes across the browser's rendering engine, JavaScript engine, networking stack, and sandboxing layers. The reporting vendor of record in this dataset is Ubuntu, which primarily indicates that the fix is being tracked and propagated through distribution packaging channels rather than identifying a Linux-specific defect; no CPE strings were provided to pin down exact platform, architecture, or version ranges. The only independent guidance available is a limiting factor rather than a technical mechanism: browser vulnerabilities in this class generally require a user to navigate to or load attacker-controlled content, meaning exposure is governed by browsing behavior and content-filtering controls rather than by a network-reachable service. Absent a vector, prerequisities such as user interaction, specific component enablement, or non-default configuration cannot be enumerated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB