EUVD-2026-89147
GHSA-c25c-28m7-f9x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to target system
-
ExploitInteract with vulnerable Chrome component
-
ExecutionBypass missing authorization check
-
ImpactAccess or modify restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an unpatched Google Chrome desktop build prior to 154.0.8037.57; users on or above that fixed version are not affected. The supplied CVSS vector indicates a local attack vector (AV:L) with no privileges or user interaction required, implying the attacker needs some form of local access or local execution context rather than a purely remote web page - but because the CVE description is unavailable, the exact triggering feature, protocol, or configuration cannot be named and should be confirmed via Chromium issue 497094708. The limiting factors are: the vulnerability is already patched, no public exploit is available, EPSS is low (0.24%), and the local vector constrains remote mass exploitation. |
| Impact | Signals conflict and key data is missing, so this should be treated as a moderate-priority patch rather than an emergency. The provided CVSS 3.1 vector scores 8.4 with AV:L (local attack vector), AC:L, PR:N, UI:N and High impact on confidentiality, integrity and availability, mapped to CWE-862 (Missing Authorization). However, the affected product is Google Chrome (154.0.8037.57), a browser whose vulnerabilities are typically network/web-content driven (AV:N) and usually require user interaction - the AV:L/UI:N combination is unusual for a browser bug and should be verified against the Chrome release notes and Chromium issue 497094708. The tag labels this an 'Authentication Bypass' while the CWE indicates Missing Authorization; these are related but not identical, and the actual description is unavailable ('[Unknown description]'), so the precise mechanism is unconfirmed. Exploitation status is benign: there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile), indicating no observed or predicted widespread exploitation. The net picture is a genuinely high-severity flaw by CVSS, but real-world urgency is tempered by low EPSS, absence of KEV/POC, and unresolved inconsistencies in the metadata - patch on a normal accelerated cycle for a ubiquitous browser. |
| Exploit ScenarioDerived | An attacker who can get a target to run or interact with malicious content in an unpatched Chrome build (154.0.8037.57) leverages a missing authorization check to perform actions or access data that should be restricted. No public exploit code is identified at time of analysis, and the unusual local attack vector in the supplied CVSS suggests the flaw may require local context rather than a drive-by web page - the exact trigger is unconfirmed because the description is unavailable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
A missing-authorization flaw (CWE-862) in Google Chrome desktop builds prior to 154.0.8037.57 can be triggered by an unauthenticated local attacker with no user interaction, and the assessed CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) rates confidentiality, integrity and availability impact as high, consistent with the 'Authentication Bypass' tagging applied by the reporting vendor. The local attack vector and absence of a user-interaction requirement mean the attacker must already have some form of local execution context on the target host, which sharply constrains mass remote exploitation; no public exploit code has been identified at time of analysis and EPSS is low at 0.24% (13th percentile). Exploitation is limited to unpatched builds and is fully mitigated by the vendor-released fix in Chrome 154.0.8037.57, so this should be handled as a moderate-priority patch rather than an emergency, though the 8.4 score and high CIA impact still warrant prompt update cycles.
Earlier versions of this analysis (1)
Ubuntu Linux is the only affected-product signal available for CVE-2026-95285, and the record arrives with no description, no CVSS score or vector, no CWE, no CPE identifiers, and no version ranges, so the concrete impact cannot be stated. The sole attribution is a vendor report from Ubuntu, which means the affected component is almost certainly a package or kernel component maintained through the Ubuntu Security Notice (USN) process rather than an upstream product named in the CVE itself. No public exploit identified at time of analysis, and no independent assessment of impact, prerequisite, or severity was possible. Real-world risk cannot be meaningfully assessed from the available data.
RemediationAI
Upgrade Google Chrome to version 154.0.8037.57 or later - Vendor-released patch: 154.0.8037.57 - delivered through the Chrome Stable Channel update described at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; verify the running build via chrome://version and confirm Chrome's auto-update mechanism is enabled rather than deferred by policy. Enterprises should force the update through Chrome Browser Cloud Management or their existing software-deployment tooling and track exposure against Chromium issue 497094708 to confirm whether any extension, enterprise policy, or platform-specific configuration is a relevant prerequisite. Because the vector is AV:L/PR:N/UI:N and the missing-authorization class implies a local boundary crossing, there is no reliable feature-disable or port-blocking workaround: the practical compensating controls are restricting interactive and unprivileged local access on shared or multi-user hosts and reducing the number of untrusted local processes that can reach the browser's privileged interfaces, with the trade-off of tightened host access and potential friction for legitimate local tooling; disabling Chrome's auto-update is not an acceptable mitigation. Given EPSS 0.24% (13th percentile) and no public exploit identified at time of analysis, this is a moderate-priority patch cycle, but the 8.4 base score and high C/I/A impact argue against long deferral.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization), which in the Chromium architecture typically means a privileged or cross-boundary operation - an inter-process call, an IPC mojo interface handler, a browser-process service, or a privileged platform API - is reachable without a proper permission check being performed before the action executes. The supplied vector AV:L/PR:N/UI:N indicates the attacker needs a local foothold (for example code executing inside a renderer or another unprivileged local process) but does not need to already hold elevated privileges, and does not need to trick the user into any interaction; the Scope:Unchanged with high C/I/A ratings implies the impact stays within the vulnerable Chrome component but covers disclosure, modification and disruption of protected data. Because the CVE description is unavailable, the specific triggering component, protocol, or configuration cannot be named from the available data and should be confirmed by consulting the Chrome Stable Channel update advisory and Chromium issue 497094708. The affected build line is the Chrome 154 stable branch, and EUVD records the affected version range as versions earlier than 154.0.8037.57.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description is unavailable, so metrics mirror the vendor-supplied local vector and CWE-862 authorization failure yielding high C/I/A; AV:L and UI:N are retained but flagged as atypical for a browser.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
An authorization weakness in Google Chrome desktop builds released before version 154.0.8037.57 allows a locally present attacker to bypass access controls without credentials or any user interaction, potentially exposing or altering data handled by the browser and disrupting its availability to the user. Because the flaw requires an attacker to already have a foothold on the endpoint, it does not present a broad internet-facing threat, and no public exploit identified at time of analysis; the risk is concentrated in high-value environments such as shared desktops, virtual desktop pools, and developer or administrative workstations. Leadership should treat this as a routine but time-bound patching obligation, not an emergency incident, while ensuring browser fleets are not left indefinitely on older builds.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB