What is the CVSS score of EUVD-2026-89142?

EUVD-2026-89142 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-89142?

Yes, a patch is available for EUVD-2026-89142. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-89142

| CVE-2026-95347 CRITICAL

Use After Free (CWE-416)

2026-09-23 vendor:ubuntu

GHSA-j6cp-cvv2-q8p3

Information Disclosure Google Use After Free Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious page
Exploit

Serve crafted web content
Execution

Trigger browser flaw
Impact

Impact (unconfirmed, description missing)

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Cannot be determined from the provided data - the description is unknown, and there is no CVSS vector, CWE, or affected-version information to identify required configuration, privileges, or user interaction. The only established facts are that this is a Google Chrome desktop stable-channel issue with a vendor patch available; whether exploitation needs user interaction (e.g., visiting a page), a specific feature, or a particular platform is not stated. Defenders should consult the Chrome Releases advisory (Sep 2026) and NVD to obtain the actual prerequisites before assessing realistic risk.
Impact	This entry is severely data-starved: the description is '[Unknown description]', and there is no CVSS score/vector, no CWE, no EPSS probability, no SSVC decision data, no POC indicator, and no KEV listing. With none of those signals present, exploitation status is 'no public exploit identified at time of analysis' and no evidence of active exploitation exists. The single meaningful positive signal is that a vendor patch is available (Chrome stable-channel desktop update, Sep 2026) and that Ubuntu tracked it - routine for Chromium-derived packages. Because Chrome is one of the most widely deployed applications on earth and browser bugs are frequently drive-by/renderer issues, the latent risk of any Chrome stable-channel security fix is non-trivial and patching should not be deferred. However, without a description, CWE, or CVSS vector, the true severity and vulnerability class cannot be determined from the provided data - this could be anything from a low-severity UI spoof to a high-severity renderer RCE. This should be treated as 'patch promptly because it is Chrome', NOT as a confirmed high-priority exploited threat. All severity-relevant fields are MISSING and must be resolved against the Chrome Releases advisory / NVD before any confident prioritization.
Exploit ScenarioDerived	The specific attack cannot be described because the vulnerability class and description are unknown. If, as is typical for Chrome desktop stable-channel security fixes, this is a web-content-triggered flaw, a plausible generic scenario is a victim visiting an attacker-controlled web page that triggers the flaw in the browser. No public exploit code has been identified in the provided data.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Google Chrome on the desktop stable channel carries a vendor-patched security defect tracked as CVE-2026-95347, disclosed through Google's Chrome Releases stable-channel update in September 2026. The actual impact is currently undetermined: no description, CVSS score or vector, CWE classification, or affected version range has been published, so the vulnerability class, whether attackers must be authenticated, and whether user interaction (such as visiting a crafted page) is required cannot be confirmed from available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS probability or SSVC decision data exists to refine the risk; this should be treated as a patch-priority item pending the details in the vendor advisory.

RemediationAI

Patch status is 'Patch available per vendor advisory' - the fix is delivered through the Google Chrome stable-channel update published in September 2026, so the primary action is to upgrade Chrome to the version named in that Chrome Releases post (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html) and confirm the installed build via chrome://version, allowing enterprise update policies to force the refresh if auto-update is deferred. On Ubuntu and other downstream Chromium consumers, apply the corresponding Chromium package or snap update so the rebased engine includes the same fix, and verify the resulting browser version rather than assuming the distribution package is current. Because the description, CWE, and affected component are unknown, no feature can be reliably disabled as a targeted workaround, so interim compensating controls must be generic and their trade-offs acknowledged: restrict or block access to untrusted web content and uncategorized sites at the proxy or DNS layer (high operational friction, breaks legitimate browsing), enforce the existing renderer sandbox and site isolation rather than relaxing them with flags (may break some embedded/legacy web apps), and constrain the browser to managed, allow-listed web applications for the highest-risk user groups (reduces usability and can push users to unmanaged browsers, which weakens the control). Monitor the Chrome Releases advisory and NVD for the eventual description and severity, and re-score the risk once a CVSS vector and CWE are published, since the current lack of EPSS, KEV, and POC signals should not be read as evidence that the flaw is unexploitable.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CVE-2026-95347 is a Google Chrome browser issue surfaced through the Chrome Releases stable-channel advisory mechanism, which is how Google typically publishes fixed security bugs after users are protected by the updated build. Because no CWE is assigned in the supplied data, the root-cause class cannot be stated with confidence - it is not possible to say whether this is a memory-safety defect in the renderer, a sandbox or IPC escape in the multi-process architecture, a same-origin/site-isolation logic error, or a flaw in a browser component such as V8, Blink, or the network stack. The absence of CPE strings, an affected version range, and any CVSS vector means the exact vulnerable component and the configuration that triggers it remain unverified; the only concrete technical anchor is that this is a desktop stable-channel Chrome fix and that the reporting source is the Ubuntu vendor feed, which implies downstream Chromium packaging (notably Ubuntu's Chromium snap/package) may need the corresponding rebase to be equally protected. Analysts should pull the Chrome Releases entry (September 2026 stable-channel update) and the associated NVD record to obtain the component, CWE, and privilege/interaction prerequisites before attempting exploit path analysis.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (vendor:ubuntu) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Ubiquitous

Google Chrome desktop, one of the most widely deployed applications worldwide

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.