EUVD-2026-89140
GHSA-3wp9-2p94-jcq7
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Impact | This is a moderately high-priority browser flaw whose signals are largely consistent but partly inferred. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, base 8.0) describes a network-reachable, unauthenticated flaw requiring user interaction (visiting a page) and winning a race window (AC:H), with a scope change (S:C) yielding high confidentiality and integrity impact but no availability impact. The CWE-367 (TOCTOU race condition) classification aligns with AC:H, since exploitation depends on hitting a narrow timing window. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation - this is not a confirmed in-the-wild threat, and AC:H plus UI:R make reliable mass exploitation harder. The single most important caveat: the description is '[Unknown description]', so the concrete vulnerable component and impact wording could not be verified - the assessment here rests on the CVSS vector, CWE, and Chrome release/chromium-issue references rather than a vendor narrative. The 'Information Disclosure' tag understates the flaw, which carries I:H (integrity) in addition to C:H, so it is not a read-only issue. Overall: real but not emergency - patch on the normal fast browser cadence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Race condition in Google Chrome's stable channel allows a remote, unauthenticated attacker who persuades a user to interact with crafted content to win a time-of-check/time-of-use window and affect data beyond the vulnerable component's security scope. The CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects high confidentiality and integrity impact with no availability impact, tempered by high attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. The flaw is addressed in the 154.0.8037.57 stable channel update, and while the vendor feed tags it Information Disclosure, the scoring indicates a broader boundary-crossing defect, so this is best treated as a moderately high-priority browser issue with partly inferred impact.
Earlier versions of this analysis (1)
Unpatched Google Chrome desktop installations remain exposed to CVE-2026-95344, a flaw fixed in a Chrome stable-channel update published on the chromereleases.googleblog.com advisory referenced for this entry. The CVE description, CVSS vector, and CWE are all unavailable in the supplied intelligence, so the exact component, impact, and prerequisites cannot be confirmed and must be read from the Chrome release notes before defenders rely on them. A vendor patch is available, no public exploit code was identified at time of analysis, and the realistic exposure is therefore limited to browsers left on pre-fix versions.
RemediationAI
The primary fix is to update Google Chrome to the stable channel release identified in the vendor advisory (154.0.8037.57 or later, per the Chrome Releases stable channel update at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); because Chrome updates are applied on next restart, users and administrators must fully close and relaunch the browser rather than leaving tabs open, and can confirm the running build via chrome://version. Organizations should enforce the update through their patch-management or enterprise policy pipeline, since a merely downloaded-but-not-restarted update leaves the running browser vulnerable. No vendor-released workaround is documented for this specific issue: the vector requires user interaction (UI:R) and unauthenticated network reach (PR:N), so compensating controls are limited to reducing exposure to untrusted content and ensuring the renderer sandbox and site isolation remain enabled (do not launch with --no-sandbox or with sandbox-disabling flags, which would widen the impact of any scope-change condition) and restricting third-party extensions from broad host permissions - these measures lower likelihood but do not eliminate the race, so they should be treated as interim only until the patched build is deployed. Given patch availability from the vendor and no KEV listing or public exploit code at time of analysis, remediation should proceed on a normal high-priority cycle rather than emergency out-of-band change control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-367, Time-of-check Time-of-use (TOCTOU) Race Condition: a resource's state is validated at one moment and relied upon later, leaving an exploitable window in which that state can be changed. In a multi-process browser such as Chromium, this class typically surfaces in browser-process handling of renderer-supplied resources and IPC (file handles, shared memory, permissions or object identity), where the checks and the subsequent use occur at different times and a renderer or page can interpose between them. The presence of S:C (Scope Changed) in the vector is notable - it indicates the vulnerable component can affect resources under a different security authority, consistent with a sandbox or process-boundary issue rather than a purely in-page defect. The UI:R metric means exploitation requires a user action (for example, navigating to or interacting with attacker-controlled content), and AC:H indicates the race window is narrow and unreliable to win, which materially limits mass exploitation. The CPE-style affected-version record from EUVD is malformed (rendered as "Chrome 154.0.8037.57 <154.0.8037.57"), so the precise pre-fix build boundary cannot be confirmed from the feed alone; the underlying bug is tracked in the restricted Chromium issue 548611433, and the tag applied by the reporting feed (Information Disclosure) sits somewhat uneasily with the high confidentiality and integrity subscores, suggesting a boundary-crossing or memory-handling defect whose full impact is inferred rather than documented.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome users across the organization are affected by a high-severity race condition that could enable remote attackers to bypass security boundaries and compromise data confidentiality and integrity. No public exploit identified at time of analysis, yet the broad deployment of Chrome and the potential for data exposure warrant immediate attention. Leadership should ensure rapid patching to mitigate organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB