What is the CVSS score of EUVD-2026-89138?

EUVD-2026-89138 has a contested CVSS base score of 4.7 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-89138?

Yes, a patch is available for EUVD-2026-89138. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-89138

| CVE-2026-95332 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-09-23 vendor:ubuntu

GHSA-fxwp-7mhj-qfm2

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.7 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Exploit

Serve crafted content to Chrome
Execution

Trigger undisclosed browser flaw
Impact

Impact undetermined (no CVSS data)

Vulnerability Assessment

Weakness	CWE CWE-457 ASVS 5.0 V15 - Secure Coding and Architecture Variable initialization checks
Exploitation Conditions	Cannot be specified from the available data: the description is empty and no CVSS vector or CWE is provided, so no exact feature, protocol, configuration, or deployment prerequisite can be named. Based only on the Chrome desktop stable-channel context, exploitation of this vulnerability class would typically require the victim to run an unpatched Chrome desktop build and to load attacker-controlled web content (user interaction), but this is inferential and not confirmed by the input. The primary limiting factor is Chrome's automatic-update mechanism, which deploys the available patch rapidly and shrinks the exposure window; concrete authentication and interaction requirements are not confirmed from available data.
Impact	This entry is a near-empty data-void CVE: it carries no description, no CVSS base score or vector, and no CWE, so none of the usual severity signals (attack vector, complexity, privileges, technical impact) can be evaluated. There is no EPSS score, no CISA KEV listing, and no public POC identified in the input, so all exploitation-probability signals are absent. The only substantive intelligence is that the sole reference is the Google Chrome Releases 'Stable Channel Update for Desktop' blog for September 2026, that a vendor patch is available, and that it was reported via vendor:ubuntu. This strongly indicates the CVE is one of a large batch of Chrome desktop stable-channel security fixes shipped together in September 2026 - individually undisclosed pending broad patch uptake, which is Google's standard practice. Because the affected product (Chrome) is ubiquitous, any genuinely exploitable memory-safety or renderer bug in this class would warrant prompt patching; however, with no severity data, no exploitation evidence, and no vuln class, this cannot currently be triaged as a confirmed high priority. Treat it as 'patch as part of the routine Chrome auto-update cycle' unless Google or NVD later publishes a description, severity, and CWE. Key data explicitly missing: description, CVSS vector, CWE, EPSS, and any exploitation indicators - verify against the Chrome Releases advisory and NVD when populated.
Exploit ScenarioDerived	Because no description or CVSS data is provided, the exact attack is unknown; based only on the Chrome stable-channel context, a typical scenario for this class would be a user navigating their Chrome browser to a crafted or compromised web page that triggers a flaw in a browser component. No public exploit code is identified in the input, and no active exploitation is confirmed.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome desktop on the stable channel is the affected product behind CVE-2026-95332, a defect significant enough that Google shipped the fix in a stable-channel update rather than holding it for a routine release, yet the entry carries no description, no CVSS base score or vector, and no CWE, so the precise attack surface and technical impact cannot be named from available data. The practical consequence is therefore indeterminate: an unpatched Chrome desktop build is potentially exposed, but whether the flaw yields memory corruption, sandbox escape, information disclosure, or something else cannot be confirmed, and the only reasonable exposure model is the generic browser one in which a victim loads attacker-controlled web content with user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so the dominant risk factor is simply the population of users running unpatched builds, which Chrome's automatic-update mechanism continually shrinks.

RemediationAI

The vendor has provided a patch, so remediation is straightforward in principle: patch available per vendor advisory - update Google Chrome to the fixed desktop stable build named in the September 2026 release note at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, which in practice means allowing the built-in updater to complete and then fully restarting the browser (closing all windows, or checking chrome://settings/help to force the update check and confirm the applied version). On Ubuntu and other Debian-family systems, refresh the Chromium/Chrome package through the normal channel (for example snap refresh chromium or an apt update/upgrade cycle for chromium-browser) and verify the installed version against the upstream advisory, since the entry originated from the ubuntu vendor feed and downstream packages typically lag the upstream release by hours to days. Because no details of the flaw are available, no feature can be selectively disabled and no port or endpoint can be blocked with confidence, so compensating controls should be generic and are inferior to patching: enforce browser auto-update via enterprise policy so that endpoints cannot silently fall behind, use browser management (minimum version enforcement through Chrome Browser Cloud Management or equivalent) to inventory and flag stale builds, and restrict or sandbox high-risk web browsing until the patch is confirmed deployed - each of these adds administrative overhead and, in the case of content restrictions, degrades user productivity without eliminating the underlying exposure. Users who cannot immediately restart the browser should be treated as unpatched, since Chrome typically applies a downloaded update only after a restart.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The reference attached to this entry is a Google Chrome stable-channel release note (chromereleases.googleblog.com, September 2026), which places the defect inside the Chrome desktop browser stack rather than in a server-side or network service. Chrome's architecture - a privileged browser process brokering a multi-process renderer sandbox, with the Blink rendering engine and V8 JavaScript engine running untrusted content behind Site Isolation - means an unspecified Chrome defect of security severity typically involves either renderer-side memory corruption in Blink/V8, an inter-process communication or sandbox-boundary weakness, or a logic flaw in a browser feature reachable from web content. Which of these applies here cannot be determined: no CWE is supplied to indicate the root-cause class (for example CWE-787 out-of-bounds write, CWE-416 use-after-free, or CWE-20 improper input validation), and no CPE strings are provided to pin the affected component or platform variants. The entry is attributed to the ubuntu vendor feed, which suggests downstream distribution packaging of Chromium/Chrome on Ubuntu tracks the same upstream stable release, but no Ubuntu-specific advisory appears among the references. With no CVSS vector present, authentication and interaction requirements are not confirmed from available data; the assessed view is explicitly inferential, noting only that the standard browser exposure model would require running an unpatched desktop build and rendering attacker-supplied content.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

SUSE CRITICAL

Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.3%

Top 81% exploitable

Prevalence

Ubiquitous

Google Chrome desktop, dominant browser across nearly all environments

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +24

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.