What is the CVSS score of CVE-2026-95384?

CVE-2026-95384 has a contested CVSS base score of 5.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-95384?

Yes, a patch is available for CVE-2026-95384. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-95384

EUVD-2026-89129 MEDIUM

Race Condition (CWE-362)

2026-09-23 vendor:ubuntu

GHSA-75x3-3h4r-xhxg

Information Disclosure Google Race Condition Suse

Medium

Disputed · 5.3 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Exploit

Deliver crafted web content to browser
Execution

Trigger flaw in Chrome component
Impact

Achieve unconfirmed impact (RCE/info-leak/crash)

Vulnerability Assessment

Weakness	CWE CWE-362 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Concurrency control, locking MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Cannot enumerate exact prerequisites because no description or CVSS vector was provided. For Google Chrome desktop the typical exploitation path requires the victim to load attacker-controlled web content (user interaction via visiting a page), and the affected component/feature is unspecified in the input. Chrome's automatic-update mechanism strongly limits the exposure window: patched builds are pushed rapidly, so only outdated installations remain at risk. The precise required conditions must be confirmed from the linked Chrome Releases advisory.
Impact	Data is severely limited: no description, no CVSS score/vector, and no CWE were provided, so the specific vulnerability class, attack vector, and impact cannot be determined from the input. The only substantive signal is the sole reference - a Google Chrome Releases 'Stable Channel Update for Desktop' blog post (Sep 2026) - combined with 'reported by vendor:ubuntu' (Ubuntu's security tracker mirroring the upstream Chrome fix) and 'Patch: Available from vendor.' This identifies the affected product as Google Chrome desktop with high confidence but nothing about severity. There is no EPSS score, no CISA KEV listing, and no public POC in the input, so exploitation status is: no public exploit identified at time of analysis. Chrome stable-channel batch fixes are typically memory-safety issues (often rated High) that Google patches proactively; because Chrome auto-updates, the practical risk window is short for up-to-date installs but the ubiquity of the product makes any browser flaw broadly relevant. Bottom line: cannot be scored as a real priority without the missing CVSS/CWE/description - treat as a routine 'apply the Chrome update' item unless the vendor advisory reveals active exploitation or a critical rating. Missing data explicitly: description, CVSS vector, CWE, EPSS, and exact fixed version - verify against the linked Chrome Releases advisory.
Exploit ScenarioDerived	Based on the product (Chrome desktop browser), the most plausible scenario is a user navigating to a malicious or compromised web page that triggers the flaw in the browser's rendering/JavaScript engine or a component, but the exact mechanism is unknown because no description or CVSS vector was provided. No public proof-of-concept is identified in the input. The specific impact (code execution, sandbox escape, info leak, or crash) cannot be confirmed without the vendor advisory.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop installations are affected by a flaw corrected in a stable channel update, with vendor patch data indicating a fix is available but no description, CVSS score, CVSS vector, or CWE supplied to characterize the defect. Because neither the affected component nor the attack vector is specified in the available intelligence, the impact cannot be assessed beyond Chrome's general exploitation model, in which a victim would need to load attacker-controlled web content for an exploit attempt to succeed. No public exploit identified at time of analysis, and Chrome's automatic-update mechanism sharply limits exposure so that primarily outdated installations remain at risk; the linked Chrome Releases advisory is the authoritative source for the exact affected build and fix.

RemediationAI

Patch available per vendor advisory. The primary action is to update Google Chrome to the current stable channel release described in the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html), which is the only version-specific guidance available, since no exact fix version number was included in the input and none should be assumed. On managed Windows, macOS, and Linux fleets this means allowing Chrome's built-in auto-update to complete and prompting users to relaunch the browser, because the fix is not active until the browser process restarts; on Ubuntu, the equivalent fix arrives through the distro packaging channel, so run a full apt update and upgrade of the chromium/chrome package and track the Ubuntu security notice tied to the vendor:ubuntu attribution, accepting that distribution rebuild and QA latency can leave hosts exposed longer than the upstream channel would. Where immediate patching is not possible, the actionable compensating controls are to restrict high-risk browsing through policy (blocking untrusted sites and drive-by ad networks), enforce strict site isolation and the browser sandbox rather than disabling them for compatibility, disable or remove unneeded extensions to shrink renderer and privileged-extension attack surface, and consider running untrusted web content in a disposable VM or remote browsing isolation; each of these reduces but does not eliminate risk and introduces usability or performance trade-offs. Network-level filtering alone is a weak control here because the attack path is content delivered through normal web browsing, not a single predictable port or endpoint.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The input contains no CWE, no CPE strings, and no CVSS vector, so the vulnerability class (memory corruption, type confusion, use-after-free, sandbox escape, inappropriate implementation in a browser subsystem, etc.) and the precise affected component inside Chrome cannot be determined from the provided data. What can be stated from the technology stack is that Google Chrome is a multi-process browser built around a renderer sandbox and site isolation; the majority of historically patched Chrome bugs are reachable by rendering attacker-controlled HTML/JavaScript in a renderer process, while sandbox-escape classes additionally require a compromised renderer to pivot into the browser or OS process. The reference to a Chrome Releases stable channel update confirms this is a Google-maintained browser defect handled through the normal stable channel cadence rather than a third-party library issue, and the vendor:ubuntu attribution indicates the same fix propagates into Ubuntu's packaged Chromium/Chrome builds, where distribution rebuild and QA latency can extend the delay between upstream disclosure and end-user patching. Confirming the component, the privilege level required, and whether user interaction is mandatory requires reading the linked advisory rather than inferring from the description.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant desktop browser across nearly all environments

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).