EUVD-2026-89134
GHSA-jph2-6xcq-hwf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted content to browser
-
ExecutionTrigger flaw in Chrome component
-
ImpactImpact within browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined from the provided data - no description or CVSS vector specifies the required feature, protocol, configuration, or interaction. By analogy to typical Chrome desktop stable-channel fixes, exploitation would most likely require a user to visit or render attacker-controlled web content in the Chrome desktop browser, but this is unconfirmed. Limiting factors and exact prerequisites must be verified against the Chrome Releases advisory; treat the affected surface as the Chrome desktop stable channel prior to the Sep 2026 update. |
| Impact | This is a data-sparse entry: no description, no CVSS score/vector, and no CWE are published. The only actionable signal is that a fix is available in a Chrome Releases 'Stable Channel Update for Desktop' (Sep 2026) advisory, and the record was surfaced via vendor:ubuntu tracking. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so all three real-time exploitation signals are absent or unknown. Because the vulnerability class, attack vector, and privilege requirements are unpublished, an evidence-based severity cannot be derived - historically, Chrome stable-channel fixes span the full range from moderate to critical (renderer memory-corruption RCE reachable from a malicious web page). The honest assessment is that risk cannot be ranked from the supplied data alone; however, given Chrome's ubiquity and browsers' broad remote attack surface, standard practice is to patch promptly rather than defer. Missing data explicitly: no CVSS vector to confirm attack vector/complexity/privileges, no EPSS to gauge exploitation probability, and no description to identify the vulnerable component - all must be verified against the linked Chrome Releases advisory once Google publishes per-CVE detail. |
| Exploit ScenarioDerived | Based on the typical shape of Chrome stable-channel desktop fixes, a plausible scenario is a victim navigating to an attacker-controlled or compromised web page that triggers the flaw in the browser. The specific mechanism cannot be confirmed because no description or CVSS vector is available, and no public POC is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop stable channel builds released before the September 2026 stable-channel update are affected by CVE-2026-95374, a security issue that Google addressed in that release. The entry is data-sparse: no description, no CVSS score, no CVSS vector, and no CWE classification have been published by the vendor or any other source in the provided intelligence, so the precise flaw class, attack surface, and impact cannot be characterized from the available data - exploitation conditions are unconfirmed, and by analogy to typical Chrome desktop stable-channel fixes the issue would most likely be reachable through a user rendering attacker-controlled web content, though this remains an assumption rather than an assessed fact. No public exploit identified at time of analysis; CVE-2026-95374 is not listed in CISA KEV in the provided data, and no proof-of-concept, EPSS value, or active-exploitation reporting accompanies this record. Anyone running a Chrome desktop stable build older than the September 2026 update should treat the release note as the authoritative source and patch promptly.
RemediationAI
The primary fix is to move to the Chrome desktop stable-channel build issued in Google's September 2026 stable-channel update, per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html - patch availability is confirmed by the vendor, but the exact fixed version number is not present in the provided data, so read the specific version from that advisory rather than assuming one. Apply the update through the normal Chrome auto-update path or your managed software-deployment channel, then verify the reported version matches the advisory, since silent update failures are a common reason hosts remain exposed; on Ubuntu, also apply the Chromium package update when Ubuntu publishes its notice for this CVE, and note that snap-packaged Chromium updates on a different cadence than upstream Chrome, so the two can diverge temporarily. If immediate updating is not possible, the actionable compensating controls are narrow: enforce an enterprise policy that blocks or restricts untrusted web content and disables risky plugin/extension surfaces for the interim, accepting that this degrades user functionality and does not substitute for the patch; restrict browsing on the affected host to trusted, allow-listed sites via proxy or DNS filtering, with the trade-off of significant usability and coverage gaps; and isolate at-risk browsing in a disposable, low-privilege environment that is rebuilt frequently, which reduces but does not eliminate exposure because the flaw may be reachable in normal rendering paths. Do not rely on content filtering alone - with no description or CWE available, the exact trigger cannot be characterized, so the only reliable remediation is applying the vendor update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only substantive technical anchor in this record is its provenance: the sole reference is Google's Chrome Releases blog post for the September 2026 stable-channel update for desktop, and the reporting vendor is recorded as Ubuntu. That combination is consistent with a browser-engine or component-level fix shipped in the Chrome stable channel, with Ubuntu's security team either reporting or tracking the issue because Chromium is shipped as a snap/package on Ubuntu. No description, CPE string, or CWE is provided, so the underlying technology (whether V8, Blink, the network stack, GPU/IPC sandbox layers, or another Chromium component) cannot be identified from the data at hand; the vulnerable component should be read out of the Chrome Releases advisory itself. Likewise, the root-cause class cannot be assigned without the CWE - the input contains neither an explicit CWE mapping nor wording that would let one be inferred responsibly. The affected surface should be treated as the Chrome desktop stable channel prior to the September 2026 update; the data does not support any narrower claim about which platforms, channels (Beta/Dev/Canary), or Chromium derivatives are impacted.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB