EUVD-2026-89156
GHSA-255w-j3fm-6r98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web content
-
ExploitLure unpatched Chrome user to page
-
ExecutionTrigger browser-side flaw
-
ImpactImpact within browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Workflow enforcement
|
| Exploitation Conditions | Specific prerequisites cannot be extracted because the description is absent. Based on the affected product being Google Chrome desktop, exploitation most likely requires the victim to run an unpatched Chrome build and to interact with attacker-controlled web content (user interaction is typical for browser flaws), which limits mass unauthenticated exploitation. The exact required feature, configuration, platform, and whether interaction is truly needed remain unconfirmed and must be validated against the Chrome Releases advisory once details are published. |
| Impact | This CVE cannot be independently risk-scored because the input provides no CVSS score, no CVSS vector, no CWE, no EPSS probability, no KEV listing, and no POC indicator - the description is entirely absent ('[Unknown description]'). The only actionable signal is the single reference, a Google Chrome Releases blog post for a September 2026 stable-channel desktop update, which strongly implies this is a Chrome browser vulnerability fixed in that release. Because Google routinely batches many individually-numbered CVEs into one stable-channel post and withholds technical detail until most users have updated, the missing metadata is expected rather than anomalous. In the absence of a KEV listing, no active exploitation can be asserted (no 'in the wild' / 'zero-day' claim is justified). Chrome bugs historically trend toward memory-safety issues that are often high-severity and, for a subset, do attract real exploitation - so despite the empty scoring fields this should be treated as a routine-but-real 'patch promptly' browser update, not dismissed as low risk. Key data is missing/conflicting and must be verified against the linked Chrome Releases advisory or NVD once populated: severity, affected/fixed Chrome version, and vulnerability class are all UNKNOWN here. |
| Exploit ScenarioDerived | Consistent with the typical Chrome stable-channel bug pattern, an attacker would most plausibly host a malicious web page and lure a victim using an unpatched Chrome desktop build into visiting it, triggering the flaw within the browser's rendering or JavaScript engine. No public exploit is identified in the provided data, and the specific technical mechanism is unknown pending the detailed advisory. Actual impact and user-interaction requirements cannot be confirmed from the available metadata. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop builds prior to the September 2026 stable-channel release referenced in the Chrome Releases advisory are affected by a vulnerability whose technical details have not been disclosed, so its precise impact cannot be independently characterized. Based on the affected product class, exploitation would most plausibly require a victim to run an unpatched Chrome build and interact with attacker-controlled web content, but this is an inference from the product class rather than a confirmed exploitation precondition. No public exploit code or CISA KEV listing has been identified at time of analysis, and with no CVSS score, vector, CWE, or EPSS probability provided, no independent risk score can be assigned.
RemediationAI
The primary fix is to update Google Chrome desktop to the version published in the September 2026 stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html; the vendor reports a patch is available, though no exact fix version number was included in the provided data, so the precise build must be confirmed from that advisory. Chrome's built-in auto-update mechanism normally applies the fix without user action, but managed fleets should verify compliance via chrome://version or their endpoint management tooling, and Ubuntu users should confirm that their distribution browser package or snap has been refreshed to the corresponding fixed build. If immediate patching is not possible, compensating controls are limited and carry trade-offs: restrict browsing on affected hosts to an allowlist of trusted sites (reduces exposure but breaks general web use), enforce enterprise policies that disable unnecessary high-risk features such as JavaScript JIT via --js-flags=--jitless where operationally tolerable (meaningful but not complete mitigation, with measurable performance loss), and ensure site isolation remains enabled (Chrome default since version 67; limits renderer compromise impact but does not prevent initial exploitation). Because no exploit code has been identified publicly, aggressive network blocking is not warranted at this time, but monitoring for crashes and anomalous renderer behavior on unpatched hosts is advisable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is the Google Chrome desktop browser, a multi-process application that renders untrusted web content in a sandboxed renderer process while privileged operations are handled by the browser process. Because the input supplies no CWE, no CPE strings, and no vulnerability description, the root-cause class cannot be established; browser flaws of this type are most commonly memory-safety defects such as use-after-free or type confusion in the rendering or JavaScript engine, or logic errors in the inter-process communication layer, but any such attribution here would be speculation rather than a finding. The only concrete technical anchor is the patch reference to the Chrome Releases stable channel update blog post, which indicates the issue is fixed through Google's normal stable-channel release process. Authentication requirements are not confirmed from available data, and since neither the CVSS vector nor the description is present, no statement about attacker privilege level or user interaction can be verified beyond the general observation that browser rendering flaws typically require the victim to load attacker-controlled content.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB