EUVD-2026-89167
GHSA-v64c-m25x-vq5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious web content
-
ExploitVictim visits page in Chrome
-
ExecutionTrigger undisclosed browser defect
-
ImpactImpact undetermined (details unavailable)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Cannot be determined from available data - the CVE has no description, no CVSS vector, and no CWE, so the specific feature, protocol, configuration, or user interaction required is unspecified. Based only on product identity (Google Chrome desktop browser), exploitation would most plausibly require the victim to render attacker-controlled web content, but this is an inference, not a stated condition. Authentication requirements are not confirmed from available data. Mitigation is straightforward: the vendor patch is available and Chrome's auto-update mechanism deploys it without user action. |
| Impact | This CVE is attributable to Google Chrome (desktop stable channel) solely through its one reference - the Chrome Releases 'Stable Channel Update for Desktop' blog post dated September 2026 - and the vendor:ubuntu reporting source. Beyond that attribution, the entry is a data void: no description, no CVSS score or vector, and no CWE are provided, so attack vector, complexity, privilege, and impact cannot be assessed from the data. No EPSS score, no CISA KEV listing, and no public POC are present, so exploitation status is 'no public exploit identified at time of analysis.' Absence of EPSS/KEV is NOT evidence of low risk here - it reflects missing data, not a confirmed low-probability signal. Historically Chrome stable-channel security fixes range from low-severity UI issues to high/critical renderer memory-corruption bugs, several of which have later appeared in CISA KEV; without the description or severity rating, this specific issue cannot be triaged. Practical guidance: because a patch is available and Chrome auto-updates, apply the update rather than attempting to reason about severity from this thin record. Verify the actual severity and vulnerability class against the Chrome Releases advisory and NVD once populated. |
| Exploit ScenarioDerived | The vulnerability class is unknown because no description or CVSS vector is provided; for Chrome stable-channel flaws a typical pattern is a user navigating to an attacker-controlled web page that triggers a browser-side defect. No public exploit code has been identified for this CVE at the time of analysis. A concrete attack path cannot be responsibly detailed without the vulnerability description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome (desktop stable channel) is affected by a security defect for which the vendor has published a fix as part of its September 2026 Stable Channel Update, the single reference attached to this CVE. The record contains no description, no CVSS vector, and no CWE, so the specific vulnerable component, the attack vector, and any required user interaction are undetermined from the available data; based only on the product identity, the most plausible exploitation path would be a victim rendering attacker-controlled web content in the browser, but that is an inference rather than a stated condition. Authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis; the vendor patch is available and Chrome's auto-update mechanism deploys it without user action.
RemediationAI
Patch available per vendor advisory: the primary fix is the September 2026 Stable Channel Update for Google Chrome desktop, published at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, which lists the exact fixed build numbers per platform even though this CVE record does not carry a version string. On managed endpoints, force the update by verifying the installed version against that advisory and pushing the release through Chrome Browser Cloud Management, enterprise MSI/PKG deployment, or the platform's standard software distribution tooling, then require a full browser restart so the new binary is actually loaded (Chrome's auto-update downloads in the background but does not apply until relaunch - a common source of residual exposure; the trade-off is a brief user disruption and possible session loss). Users can force the check at chrome://settings/help. For Ubuntu and other Linux distributions, patching the upstream browser is insufficient on its own: because Ubuntu ships Chromium as a snap maintained downstream, administrators should also apply the corresponding Ubuntu Security Notice and refresh the snap (for example via 'snap refresh chromium'), accepting that the downstream package may lag the upstream release by hours to days. Where immediate update is not possible, compensating controls are blunt and partial: restricting browser use to trusted internal sites reduces exposure to attacker-controlled content but breaks general web browsing; enforcing site isolation and disabling unnecessary flags or experimental features shrinks the attack surface without eliminating it; and application allow-listing or running the browser under a hardened sandbox profile limits post-exploitation impact but adds administrative overhead and can break plugins and extensions. None of these substitutes for the vendor patch, and no mitigation is warranted beyond routine update hygiene given that no public exploit identified at time of analysis and no additional workaround is documented in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This entry is associated with the Chromium-based Google Chrome desktop browser distributed through the Chrome Releases stable channel, and it is attributable to that product solely through its one reference, the 'Stable Channel Update for Desktop' blog post dated September 2026. No CWE is assigned in the provided data, so the root-cause class (for example memory-safety corruption in the renderer, a V8 engine type-confusion flaw, an insufficient-validation issue in a browser API such as IPC, WebGPU, or permissions, or a UI-spoofing defect) cannot be determined; each of those classes carries materially different exploitation prerequisites, ranging from pure content rendering to specific API usage or user gesture. Chrome's security model is relevant context: the multi-process architecture isolates web content in a sandboxed renderer, so a renderer-level compromise typically requires a second, independent sandbox-escape bug to reach the operating system, while bugs in the browser (privileged) process can be directly impactful. The reporting source is tagged 'vendor:ubuntu', which suggests downstream coordination with a Linux distribution that repackages the browser (Ubuntu ships Chromium as a snap rather than as a Google-packaged .deb), so users of distribution-maintained builds must wait for the downstream package to be refreshed even after the upstream fix lands. No CPE strings, no CVSS vector, and no product version range were supplied, so the affected build window is unknown and must be established from the referenced Chrome Releases post.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB