What is the CVSS score of EUVD-2026-89120?

EUVD-2026-89120 has a contested CVSS base score of 5.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-89120?

Yes, a patch is available for EUVD-2026-89120. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-89120

| CVE-2026-95360 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-09-23 vendor:ubuntu

GHSA-6ch8-cr68-9w92

Information Disclosure Google Suse

Medium

Disputed · 5.3 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Exploit

Serve crafted web content
Execution

Trigger undisclosed browser flaw
Impact

Achieve attacker-defined impact in Chrome

Vulnerability Assessment

Weakness	CWE CWE-367 ASVS 5.0 V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions	Specific prerequisites cannot be extracted because the description is unavailable. Based on the product identity (Google Chrome desktop, stable channel) and typical browser-fix patterns, exploitation most plausibly requires the victim to load attacker-controlled web content in an unpatched Chrome build, implying user interaction (visiting a page) as a likely limiting factor. Concrete limiting factors - required user interaction, privilege level, sandbox constraints, affected component, and vulnerable version range - are NOT confirmable from the provided data and must be verified against the Chrome Releases advisory.
Impact	This entry is a data-void CVE with no description, no CVSS score/vector, no CWE, no EPSS, no KEV listing, and no public POC. The sole reference is the Chrome Releases 'Stable Channel Update for Desktop' blog (Sep 2026), which confirms the affected product is Google Chrome desktop and that a patch shipped in a stable-channel release. Because no CVSS vector or SSVC data is available, attack vector, complexity, privileges, and technical impact cannot be assessed from the input - any severity claim would be unsupported. Google routinely withholds bug details until a majority of users have updated, so the absence of a description is expected for freshly-disclosed Chrome fixes rather than evidence of low risk. Practically: browser-engine vulnerabilities are frequently renderer/web-content reachable and thus high-value, but with EPSS/KEV/POC all absent there is no signal of active or imminent exploitation for THIS specific ID. Treat as standard-priority browser patching (apply the Chrome update) rather than an emergency; escalate only if this CVE later appears in CISA KEV or a Chrome advisory marks it exploited-in-the-wild. Key data explicitly missing: description, CVSS vector, CWE class, and exploitation signals - verify against the Chrome Releases advisory for the assigned severity and component.
Exploit ScenarioDerived	The specific mechanism is undisclosed, but Chrome stable-channel security fixes typically involve a victim visiting or being redirected to an attacker-controlled web page that triggers a flaw in the browser's rendering/JavaScript engine or a related component. No public exploit code has been identified for this CVE at time of analysis, and no active exploitation is indicated. Exact attack vector and complexity cannot be confirmed because no CVSS vector or bug details are provided.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop on the stable channel is affected by a security defect tracked as CVE-2026-95360, which the vendor has corrected in a later stable-channel build documented on the Chrome Releases blog; the specific affected component, vulnerable version range, and impact are not confirmable because no description, CVSS score or vector, CWE, or CPE data was supplied. Based on the product identity (Chrome desktop stable channel) and typical browser-fix patterns, exploitation most plausibly requires the victim to load attacker-controlled web content in an unpatched Chrome build, making user interaction a likely limiting prerequisite that must be verified against the referenced advisory. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating confirmed active exploitation; patch available per vendor advisory.

RemediationAI

Apply the vendor fix by updating Google Chrome desktop to the stable-channel build identified in the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); because no exact fixed version number was supplied in the input data, read the advisory for the specific build and verify the installed build via chrome://version. Note that Chrome stages updates silently and only activates them after the browser is fully closed and relaunched, so users and administrators should force a complete restart (or use enterprise update policies such as Chrome Browser Cloud Management / an update-forcing policy) to ensure the patched binary is running rather than an already-downloaded-but-not-applied update; a restart interrupts active sessions and may discard open tabs. Ubuntu and other Linux users should also confirm whether their distribution-maintained Chromium package carries the matching fix, given the vendor:ubuntu attribution. If immediate updating is not possible, the practical compensating controls are limited in value for a browser defect of unknown type: reduce exposure by confining browsing of untrusted or attacker-supplied content to a fully updated browser or isolated/remote-rendering environment, keep site isolation and the sandbox enabled, restrict extension installs through policy, and prioritize patching for users who routinely open links from email or untrusted sites - none of these substitute for the vendor patch, and each carries usability or compatibility trade-offs.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The only substantive intelligence for CVE-2026-95360 is a Chrome Releases stable-channel advisory, plus a note that the entry was reported by vendor:ubuntu, indicating downstream Linux/Chromium packaging tracks the same fix. No CWE is provided, so the root-cause class (for example memory-safety corruption, type confusion, or a logic/validation defect in a browser subsystem such as V8, Blink, or the GPU/network stack) cannot be asserted and must be read from the advisory. Chrome's architecture is relevant here: renderer processes run inside a sandbox, and many such fixes address defects that a compromised renderer could leverage to escalate privileges or escape the sandbox, which is why browser fixes are typically prioritized. Google routinely withholds technical detail on security fixes until a majority of the user base has updated, which is consistent with the missing description and metrics in this record. Absent CPE strings and a version range, the exact affected build, platform (Windows/macOS/Linux), and vulnerable code path remain unconfirmed.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 19:22 NVD

5.3 (MEDIUM)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant desktop browser across virtually all environments

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.