What is the CVSS score of CVE-2026-95368?

CVE-2026-95368 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95368?

Yes, a patch is available for CVE-2026-95368. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95368

EUVD-2026-89157 MEDIUM

Incorrect Authorization (CWE-863)

2026-09-23 vendor:ubuntu

GHSA-frm8-xwpp-whgw

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Victim browses malicious web page
Exploit

Crafted content triggers Chrome flaw
Impact

Impact per undisclosed vulnerability class

Vulnerability Assessment

Weakness	CWE CWE-863 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization logic validation MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Cannot be determined from the provided data - the description is unknown and no CVSS vector is supplied, so required privileges, user interaction, attack vector, and any feature/configuration prerequisites are unspecified. The only confirmed facts are that the affected product is Google Chrome desktop (stable channel) and that a vendor patch is available via the September 2026 stable-channel update. Defenders should consult the linked Chrome Releases advisory and the eventual NVD/Google entry to establish concrete exploitation prerequisites; a stable-channel browser fix typically requires the user to render attacker-controlled web content, which is a mitigating factor relative to pre-auth server flaws.
Impact	This entry is a data-void CVE: no description, no CVSS score, no CVSS vector, and no CWE are provided. The only substantive signal is the single reference to Google's Chrome Releases blog ('Stable Channel Update for Desktop', September 2026), which confirms the affected product is Google Chrome desktop and that a fix shipped in a stable-channel update. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data, so exploitation likelihood cannot be quantified from the inputs. Because Chrome is patched via silent auto-update, the practical risk window for most users is short, but that depends entirely on the specific (undisclosed) vulnerability class - which cannot be determined here. No risk prioritization signal (severity, exploitability, automatability) is available to contradict or confirm any priority level. Treat this as a genuine-but-unclassified Chrome fix: patch via the stable-channel update, and consult the linked Chrome Releases advisory and the eventual NVD/Google entry for the actual severity and vulnerability details before making a risk-based decision.
Exploit ScenarioDerived	Because the vulnerability class, attack vector, and complexity are undisclosed in the provided data, a specific attack scenario cannot be responsibly constructed. Historically, Chrome stable-channel security fixes are reachable via a victim browsing a malicious or compromised web page that triggers the flaw in a rendering, media, or JavaScript engine component. No public exploit is identified in the supplied intelligence.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop (stable channel) is the affected product in CVE-2026-95368, a security fix shipped in the September 2026 Chrome releases stable-channel update. The entry is a data void: no description, no CVSS score, no CVSS vector, and no CWE are available from the supplied intelligence, so the specific impact class - memory corruption, sandbox escape, information disclosure, or otherwise - cannot be determined from open sources at this time. Vendor-released patch: available per the referenced Chrome Releases advisory, though no exact fixed version string is provided; there is no public exploit code and no CISA KEV confirmation, so exploitation status is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data.

RemediationAI

Primary remediation is to apply the September 2026 Google Chrome stable-channel desktop update described in the vendor advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; the patch status is best described as patch available per vendor advisory, with no exact fix version string present in the supplied data, so administrators should confirm the installed major/minor/build number against the advisory rather than assume any specific version. Ensure Chrome's built-in updater is enabled and not blocked by enterprise policy or a stale update server, then verify the reported version via chrome://version or your software inventory tooling. If immediate update is not feasible - for example, in change-controlled or validated environments - compensating controls include restricting browsing to trusted internal sites through an allowlist or URL-filtering proxy, blocking download and rendering of untrusted web content via enterprise policy, and running the browser under an OS-level sandbox or low-privilege account; each of these degrades user productivity or breaks legitimate web applications and none is a substitute for patching. Because the vulnerability class is unknown, no targeted single-feature disablement (such as a specific flag) can be recommended, and defenders should monitor the Chrome Releases and NVD entries for a detailed description that would allow tighter mitigations. Note that because the underlying flaw is not characterized here, the usual browser-side preconditions - attacker-supplied content being rendered in the affected browser - cannot be confirmed and should not be assumed to be the only exposure path.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The supplied record contains no CWE, no CVSS vector, and no CPE strings, so root-cause classification is not possible from the data. What is confirmed is the delivery vehicle: CVE-2026-95368 is addressed through Google's Chrome stable-channel update process, the periodic release train that bundles fixes for the Chromium-based browser and its bundled components (Blink renderer, V8 JavaScript engine, GPU stack, and other subprocesses). Stable-channel browser fixes typically reach users through the automatic update mechanism, and Google's Chrome Releases blog is the authoritative publication channel for the associated advisory. The absence of CPE data means the exact version range (last-affected vs. first-fixed) must be read directly from that advisory rather than inferred here. Because the record shows no patch reference to a GitHub PR or commit, the fix appears to be a tagged vendor release rather than a mid-stream upstream change. Analysts should treat the missing CWE and vector as an intelligence gap to close via the Chrome Releases post and the eventual NVD entry, not as evidence that impact is low.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)

Vendor (vendor:ubuntu) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE CRITICAL

Red Hat 4.3 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant desktop browser across nearly all environments

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.