What is the CVSS score of EUVD-2026-89159?

EUVD-2026-89159 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-89159?

Within 24 hours, query endpoint management or software inventory tooling to determine which managed devices are running Google Chrome versions earlier than 154.0.8037.57, and brief IT support and security operations that a locally exploitable confidentiality issue exists in unpatched Chrome builds. Within 7 days, deploy the vendor-released patch (Chrome 154.0.8037.57) to all Windows, macOS, and Linux endpoints via your standard browser update mechanism, confirming that Chrome auto-update is enabled and not blocked by policy, and prioritizing high-risk user groups such as executives, finance, and engineering. Within 30 days, validate patch coverage across the full estate, document any unpatched exceptions with compensating controls such as restricting local logon rights or limiting access to sensitive data on those systems, and review browser and endpoint telemetry for signs of exploitation before formally closing the remediation item.

Google Chrome EUVD-2026-89159

Q: Which versions of Google Chrome are affected by EUVD-2026-89159?

A confidentiality flaw in Google Chrome versions prior to 154.0.8037.57 could allow an attacker with local access to an endpoint to read sensitive data that should have been discarded, primarily…. A patch is available.

| CVE-2026-95326 HIGH

Incomplete Cleanup (CWE-459)

2026-09-23 vendor:ubuntu

GHSA-rc23-4fv3-pcr7

Information Disclosure Google Suse

8.4

CVSS 3.1 · Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local access to victim host
Exploit

Trigger incomplete-cleanup code path in Chrome
Execution

Read uncleared sensitive resource
Impact

Exfiltrate disclosed data

Vulnerability Assessment

Weakness	CWE CWE-459 ASVS 5.0 V15 - Secure Coding and Architecture Incomplete cleanup
Exploitation Conditions	Exploitation is bounded by the local attack vector (AV:L): the attacker needs local presence or the ability to execute within the browser/host context on a system running Google Chrome prior to 154.0.8037.57; it is NOT a remote drive-by against a default install despite PR:N/UI:N. The specific feature, configuration, or resource whose cleanup is incomplete cannot be named because the CVE description is unavailable - defenders should consult Chromium issue 533041383. The primary limiting factor is the requirement for local access, which substantially narrows realistic exploitation compared to a network-facing browser flaw, and the fix is already available via the Chrome stable update.
Impact	Signals here are mixed and lean toward LOWER real-world urgency than the 8.4 base score suggests. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - notably AV:L (local), meaning exploitation requires local access to the host rather than a drive-by web attack, which is unusual framing for a browser engine bug and worth verifying against the (unavailable) description. EPSS is only 0.25% (15th percentile), indicating very low modeled probability of exploitation in the near term. The CVE is NOT in CISA KEV and no public POC is referenced, so this is no public exploit identified at time of analysis. There is no SSVC decision data provided. The CWE is CWE-459 (Incomplete Cleanup) and the only category tag is 'Information Disclosure', which conflicts with the vector's I:H/A:H (high integrity and availability impact) - an incomplete-cleanup/info-leak issue would more typically be confidentiality-dominant, so the I:H/A:H metrics should be verified with Google/Chromium. Net: a patched, low-EPSS, non-KEV local-vector Chrome bug - routine patch-cycle priority, not an emergency, though Chrome's ubiquity means it should still be rolled out promptly.
Exploit ScenarioDerived	With AV:L, an attacker who already has local access or the ability to run code/content in the browser context on the victim host leverages incomplete cleanup of a resource to read sensitive data left in memory or disk from a prior session. Given the 'Information Disclosure' classification, the likely payoff is leaked credentials, tokens, or other process memory rather than full remote takeover. No public proof-of-concept is referenced in the provided intelligence.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 02, 2026

Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.

Earlier versions of this analysis (1)

v1 Sep 24, 2026 - 02:46

No security impact can be established for CVE-2026-95326 from the available data: the description is empty, no CVSS score or vector is provided, no CWE is assigned, and no CPE or version information accompanies the record. The only intelligence available is a provenance tag indicating the issue was reported by the vendor source 'ubuntu', which implies the affected component is an Ubuntu-maintained package or image but does not identify which one. No public exploit code has been identified at time of analysis, and exploitability, attack vector, privileges required, and user interaction are all undetermined; treat this record as unresolvable until the upstream advisory, package name, and affected versions are obtained.

RemediationAI

Vendor-released patch: Chrome 154.0.8037.57, distributed through the Chrome stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html. Update Chrome to 154.0.8037.57 or later and restart the browser so the new binary is running; enterprise administrators should force the update through their management console and verify the reported version on endpoints, since merely downloading the update without relaunching leaves the vulnerable process in place. Organizations that cannot immediately patch should treat this as a low-priority local exposure rather than a network emergency and apply compensating controls that reduce the local attack surface: restrict interactive and process-level access to machines running affected Chrome builds, tighten endpoint detection for unusual cross-process reads or data exfiltration from the browser profile, and consider disabling or sandboxing non-essential local extensions and integrations that could act as the local foothold. These measures are palliative only - they do not fix the incomplete cleanup and may degrade usability or break browser-integrated workflows, so the update to 154.0.8037.57 remains the definitive remedy. No workaround in the Chrome advisory replaces the patch, and Chromium issue 533041383 should be consulted for any further vendor guidance once its details are available.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause class is CWE-459 (Incomplete Cleanup): some resource, buffer, or artifact handled by Chrome is not fully purged at the end of its lifecycle, so residual sensitive data can be observed by an attacker who already has a foothold on the host. Because the CVE description is unavailable, the specific feature, configuration, or resource involved cannot be named; the authoritative technical detail lives in Chromium issue 533041383 and the Chrome stable channel release notes. The affected surface is the Chrome browser (EUVD lists affected versions as prior to 154.0.8037.57), consistent with the CPE for Google's Chromium/Chrome desktop builds; the reporting credit comes from the Ubuntu vendor channel, which packages and tracks Chromium, so downstream Chromium-based and distro-packaged browsers should be treated as in scope. The attack vector is local (AV:L) with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), which means a process or user already executing in the browser's or host's context can trigger the flaw without a victim clicking anything - but it still cannot be reached across the network. Our assessment scopes the impact to information disclosure only (C:H/I:N/A:N), unlike the vendor base vector, which also asserts high integrity and availability impact.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.2 MEDIUM

Retained AV:L per input; CWE-459 incomplete-cleanup tagged as Information Disclosure implies confidentiality-only impact, so I and A set to N pending vendor detail.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE CRITICAL

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 02, 2026 - 13:22 NVD

8.4 (HIGH)

DescriptionCVE.org

[Unknown description]

Executive ViewAI

Why It Matters

A confidentiality flaw in Google Chrome versions prior to 154.0.8037.57 could allow an attacker with local access to an endpoint to read sensitive data that should have been discarded, primarily affecting managed user workstations and high-value devices rather than internet-facing services. Because realistic exploitation requires local presence or code execution within the browser or host context, the practical risk is narrower than the 8.4 base score suggests, and a vendor patch already exists. Leadership should treat this as a routine but time-bound browser remediation item, with urgency driven by the population of unpatched endpoints rather than by any observed exploitation.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 85% exploitable

Prevalence

Ubiquitous

Google Chrome is among the most widely deployed browsers worldwide

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.