What is the CVSS score of CVE-2026-95370?

CVE-2026-95370 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95370?

Yes, a patch is available for CVE-2026-95370. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95370

EUVD-2026-89118 MEDIUM

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-09-23 vendor:ubuntu

GHSA-33q3-82m7-96mm

Information Disclosure Google Red Hat Suse

Medium

Disputed · 5.4 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Exploit

Trigger unspecified Chrome flaw
Impact

Undetermined impact on browser

Vulnerability Assessment

Weakness	CWE CWE-841 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Workflow enforcement
Exploitation Conditions	Cannot be determined from available data - the CVE has no description, CVSS vector, or CWE. As a Google Chrome desktop stable-channel fix, exploitation most commonly requires the victim to browse attacker-influenced web content with a vulnerable, unpatched Chrome desktop build, but the exact prerequisite feature, protocol, or configuration is not specified in the provided intelligence. Consult the linked Chrome Releases advisory and the Ubuntu security notice for the concrete conditions.
Impact	Risk cannot be quantitatively assessed from the provided data: no description, no CVSS score/vector, and no CWE are supplied, so attack vector, complexity, privilege, and impact are all unknown. There is no EPSS score, no CISA KEV listing, and no public POC referenced - exploitation status is 'no public exploit identified at time of analysis.' The single reference is Google's Chrome Releases 'Stable Channel Update for Desktop' blog (Sep-2026), which confirms this is a Google Chrome desktop stable-channel fix carried downstream by Ubuntu, and a patch is available. The dominant risk driver here is prevalence, not signal severity: Chrome is deployed near-universally, so even an unrated flaw warrants prompt patching per normal browser-update hygiene. However, with no severity metadata to distinguish a low-severity hardening fix from a high-severity memory-corruption or sandbox-escape bug, this cannot be triaged as a confirmed priority - it should be treated as 'patch on the standard browser cadence' rather than emergency response. Missing data (description, CVSS, CWE) should be resolved by consulting the Chrome release notes and the Ubuntu security advisory before any exception is granted.
Exploit ScenarioDerived	A specific exploit scenario cannot be constructed because the vulnerability description, class, and CVSS vector are all absent. Based only on it being a Chrome desktop stable-channel fix, a plausible-but-unconfirmed pattern for such fixes is a user browsing to attacker-controlled web content that triggers a flaw in the renderer or a browser component; the concrete mechanism is unknown. No public exploit code is referenced.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop stable-channel installs are covered by a vendor fix for CVE-2026-95370 published in Google's Stable Channel Update for Desktop, but the supplied intelligence contains no description, CVSS score, vector, or CWE, so the concrete impact and attack path cannot be characterized here. No public exploit identified at time of analysis, and the CVE is not listed as confirmed actively exploited (CISA KEV), though exploitability cannot be ruled out given the absence of technical detail. Ubuntu is the reporting vendor, so Chromium packages on that distribution built from the same upstream fix should be treated as in scope alongside Chrome on Ubuntu systems.

RemediationAI

Patch available per vendor advisory: Google published a fix in the Stable Channel Update for Desktop referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, and that advisory is the place to read the exact fixed build, since the specific version number is not contained in this dataset and must not be assumed. Ubuntu users should apply the matching package update from the Ubuntu security team (the reporting vendor) once the notice for this CVE is available, and fully restart the browser afterward so the patched binary is loaded rather than a cached one. If immediate patching is not possible, the workable compensating controls are to enforce Chrome's automatic update policy through enterprise policy so stale unmanaged builds are not left running, and to route high-risk browsing through a remote browser-isolation or virtualized environment until the fixed build is deployed; both reduce exposure but neither removes the vulnerability from an unpatched local installation, and update-enforcement policies can break workflows that depend on pinned or legacy browser versions. No vendor-published workaround specific to the affected component is identifiable from the provided data.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

No CWE is supplied, so the root-cause class cannot be stated and this analysis does not assign one. The only structural facts available are that the issue is a Google Chrome desktop stable-channel fix documented on the Chrome Releases blog and that it is tracked by the Ubuntu security team as the reporting vendor. Chrome's security architecture centers on a multi-process model with a renderer sandbox, site isolation, and separate GPU and network service processes, and stable-channel fixes of this form typically land in one of those components or in the browser's media/network stack, but without a CWE, component identifier, or CPE string naming exact affected builds, the specific library, protocol, or attack surface is unverified. The linked advisory should be treated as the authoritative source for the affected component and version range rather than inferring one from this dataset.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE CRITICAL

Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Sep 30, 2026 - 22:08 NVD

5.4 (MEDIUM)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Ubiquitous

Google Chrome is among the most widely deployed desktop browsers worldwide

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +27

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.