EUVD-2026-89126
GHSA-9xq6-mjhg-5f35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted content to Chrome
-
ExecutionTrigger flaw in browser component
-
ImpactImpact within browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation prerequisites are not documented in the provided data - no description or CVSS vector is available. Based on the Chrome stable-channel desktop advisory context, a realistic limiting factor would be that the victim must run an unpatched Chrome desktop build and typically interact with attacker-controlled web content; however, the exact feature, vector, and whether user interaction is required cannot be confirmed from the input and must be verified against the Chrome Releases advisory or NVD once the record is populated. |
| Impact | This entry is a data-void CVE: no description, no CVSS score or vector, and no CWE were provided, so raw severity cannot be computed from the input. The single available reference is the Google Chrome Releases blog stable-channel desktop update (September 2026), and a vendor patch is available - this strongly implies the CVE is one of a batch of vulnerabilities fixed in a Chrome stable-channel security release. Because Chrome ships all security fixes in a bundled channel update, the presence of the chrome-releases advisory reliably ties this ID to the browser even though the specific bug class is unstated. No EPSS score, no CISA KEV listing, and no public POC are indicated in the input, so there is no positive signal of active exploitation or automatable mass exploitation. Net assessment: without a CVSS vector or description this cannot be confirmed as a high-real-risk item, but Chrome renderer/browser flaws historically warrant prompt patching because the product is ubiquitous and web-exposed; the operative risk-reduction action (updating to the patched stable build) is already available. Key data is missing - vuln class, attack vector, and privilege requirements are all UNKNOWN and must be verified against the Chrome Releases advisory or the NVD record once populated. |
| Exploit ScenarioDerived | Consistent with typical Chrome stable-channel security fixes, a likely scenario is a user browsing to a maliciously crafted web page that triggers a flaw in the browser's rendering or JavaScript engine. No public exploit code is identified in the provided data, and the specific vulnerability class is not documented, so this scenario is inferred from Chrome's usual patch profile rather than confirmed from the CVE description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop builds are the subject of a stable-channel security release documented in Google's Chrome Releases advisory, referenced under CVE-2026-95363, which was reported by the Ubuntu vendor channel. The record is effectively a data void: no description, CVSS score or vector, CWE, or CPE data were supplied, so raw severity cannot be computed and the affected feature, attack vector, and whether user interaction is required remain unconfirmed. There is no public exploit identified at time of analysis and no CISA KEV listing, while a vendor patch is available per the vendor-reported patch data; treat this as an undetermined-severity item until the advisory and NVD record are populated, and apply the Chrome stable-channel update as the primary action.
RemediationAI
Primary action: apply the vendor patch - patch status is 'Patch available per vendor advisory', but no exact fixed version number was included in this record, so confirm the corrected stable-channel build from the Chrome Releases post at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html before certifying remediation, and do not rely on an invented version number. On managed desktops, force the Chrome update check via chrome://settings/help or your enterprise update policy and verify the reported version post-update; on Ubuntu, update the OS-packaged Chromium/Chrome through apt or the snap channel so the distribution's fixed build is installed, noting that snap-based Chromium and Google's own .deb both need attention if both are present. If immediate patching is not possible, the practical compensating controls are to restrict browsing to trusted, allow-listed sites and block untrusted content categories at the web gateway (trade-off: breaks general internet access for users and can be bypassed by off-network browsing), and to constrain risky browser capabilities via enterprise policy, for example disabling unnecessary extensions and, where operationally tolerable, tightening site isolation or JavaScript-dependent features (trade-off: functional breakage of internal web applications). Because the record carries no CVSS score or vector, do not downgrade or upgrade its priority on assumed severity; track it against the vendor advisory until NVD populates the description and metrics.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only concrete technical anchor in the provided intelligence is a Chrome Releases stable-channel update for desktop, published on Google's chromereleases.googleblog.com blog and linked here as an advisory reference. Chrome desktop is built on the Chromium open-source project and ships bundled third-party components (for example the JavaScript engine, rendering and graphics layers, and media/network stacks), any of which could be the subject of a stable-channel fix, but no description, CWE, or CPE string was provided, so the specific vulnerable subsystem and its root-cause weakness class cannot be identified from the input. Because there is no CVSS vector, authentication and user-interaction requirements cannot be confirmed from the available data; based on the Chrome desktop stable-channel context alone, a realistic limiting factor for most such issues is that a victim runs an unpatched build and interacts with attacker-controlled web content, which must be verified rather than assumed. The 'reported by vendor:ubuntu' tag indicates the packaged Chromium/Chrome distribution channel for Ubuntu is tracking the same upstream fix, which matters for Linux fleets that receive browser updates through the OS package manager or snap rather than through Chrome's own updater.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB