EUVD-2026-89144
GHSA-h4rv-ph2v-c4x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted web content
-
ExecutionTrigger undisclosed Chrome flaw
-
ImpactImpact within browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Specific prerequisites are undisclosed in the available data (no description or CVSS vector). Based on product identity, exploitation of a Chrome desktop stable-channel flaw generally requires the victim to load attacker-influenced web content in the browser, implying user interaction (visiting a page). Authentication requirements are not confirmed from available data. A fixed build is already published, so the primary limiting factor for defenders is patch rollout: unexploited only until users update to the patched stable-channel version. Exact affected/fixed versions must be obtained from the linked Chrome Releases advisory. |
| Impact | Risk cannot be quantitatively assessed from available data: no CVSS score/vector, no CWE, no EPSS probability, no SSVC decision inputs, and no KEV listing or POC. The only positive signals are that this is a Google Chrome desktop stable-channel security fix (per the Chrome Releases blog reference) and that a patch is already available. Chrome security fixes shipped in stable-channel updates are historically a genuine priority because the browser is a ubiquitous, internet-facing attack surface frequently targeted via drive-by web content, and Google typically withholds bug detail until the fleet is patched - which is consistent with the missing description here rather than indicating a low-risk issue. However, with NO exploitation status, NO CVSS, and NO stated vulnerability class, any severity claim would be speculation. Treat as: patch-worthy by default due to product ubiquity and available fix, but true severity is UNVERIFIABLE from this dataset. Key data explicitly MISSING: description, CVSS vector, CWE, affected/fixed version numbers, and exploitation signals - verify against the linked Chrome Releases advisory and the corresponding chromium bug ID. |
| Exploit ScenarioDerived | The realistic attack surface for a Chrome desktop stable-channel flaw is drive-by exploitation: a user browses to an attacker-controlled or compromised web page whose crafted content triggers the vulnerability in the browser process. No public exploit code or active exploitation is identified for this specific CVE at time of analysis, and the actual vulnerability class and preconditions are undisclosed in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome on the desktop stable channel is the only affected product identified by the supplied intelligence, which consists of a single Chrome Releases stable-channel advisory, and the specific vulnerability class, affected component, and impact are not disclosed in the available data. No CVSS score or vector, CWE, EPSS probability, or KEV listing accompanies this record, so severity cannot be quantified and the exploitation prerequisites remain unconfirmed; there is no public exploit identified at time of analysis. Because a fixed build is already published, residual risk is chiefly a patch-rollout problem - users remain exposed only until they move to the patched stable-channel version - and no exploitation activity, in-the-wild evidence, or proof-of-concept has been reported in the data provided.
RemediationAI
Patch available per vendor advisory: the primary action is to update Google Chrome on the desktop stable channel to the fixed build documented in the linked Chrome Releases advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html), since the exact version string is not carried in the provided data and should not be assumed. On managed fleets, Chrome can be forced onto the fixed build by enabling the RelaunchNotification policy (value 2 for a forced relaunch) with a short RelaunchNotificationPeriod, and version state should be verified via chrome://version or the equivalent registry/plist inventory query; the trade-off is that a forced relaunch interrupts active browsing sessions and can discard unsaved in-page work, so schedule it deliberately. On Ubuntu or other Linux distributions where the package is tracked by the distribution, apply the corresponding chromium or chrome package update through the normal package manager (apt/snap) rather than a manual binary swap, accepting that distribution builds may lag the upstream stable release and that snap-based installations refresh on their own schedule. Because the vulnerable component is undisclosed, no targeted feature-disable or port-block mitigation can be named without inventing detail; the honest compensating controls are to treat the browser as an untrusted, rapidly-updatable endpoint - restrict the ability of users to run stale builds, avoid deferring updates past the next stable cycle, and monitor the advisory for follow-up technical write-ups that may later justify disabling a specific feature. There is no vendor-reported workaround in the available data, and no public exploit code was identified at time of analysis, so mitigation urgency should be driven by patch-rollout coverage rather than by active-exploitation indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chrome is delivered through a staged release-train model (Canary, Dev, Beta, Stable), and Google's Chrome Releases blog publishes stable-channel updates that typically bundle fixes for multiple internally and externally reported bugs rather than documenting a single flaw in isolation. That is the pattern reflected here: the sole reference is a stable-channel update post carrying a build identifier in its URL, with no per-bug technical write-up, no CWE mapping, and no CVSS vector supplied. The absence of a CWE means the root-cause class cannot be established from the data - it could be a memory-safety defect in the renderer, a type-confusion or use-after-free issue, a sandbox-escape, an inappropriate-implementation or validation flaw, or a policy/permission bypass - and the absence of affected-component information means the vulnerable subsystem (Blink, V8, GPU, networking, extensions, or installer/updater) is likewise unknown. No CPE strings were provided, so product identification rests entirely on the Chrome Releases advisory plus the Ubuntu vendor reporting tag; no assessment is offered as to whether the affected surface is remotely reachable through web content, though the standard Chrome threat model generally requires a victim to load attacker-influenced content, which is the basis for the exploitation-prerequisite note. Google's customary practice of withholding detail until a majority of the installed base has updated explains the sparse public record, and the referenced advisory should be consulted for the authoritative list of affected and fixed builds.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB