What is the CVSS score of EUVD-2026-89211?

EUVD-2026-89211 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-89211?

Within 24 hours, inventory Chrome desktop versions across the fleet through endpoint management or browser version reporting and confirm that the latest vendor-fixed Chrome stable channel release referenced in the Google advisory is available and not being blocked by update policy, proxy, or firewall rules; prioritize executive, finance, engineering, and privileged-access endpoints, and ensure users fully restart Chrome so the update takes effect. Within 7 days, deploy the fixed Chrome stable release to all remaining managed desktops and to unmanaged or BYOD devices permitted to reach corporate email and SaaS applications, targeting at least 95% compliance and forcing relaunch where necessary; verify that no enterprise policy or extension is pinning endpoints to older builds, and check terminal servers, VDI images, and golden images for stale Chrome versions - noting that no public exploit has been identified at time of analysis, so this should be scheduled as urgent remediation rather than emergency crisis response. Within 30 days, remediate the remaining long-tail, remote, and hybrid devices, escalate any endpoint that cannot be updated to owner-level accountability, and integrate browser patch-level reporting into recurring vulnerability management metrics.

Google Chrome EUVD-2026-89211

Q: Which versions of Google Chrome are affected by EUVD-2026-89211?

A critical memory-corruption vulnerability in Google Chrome desktop exposes any employee who browses the web on an unpatched machine to potential full endpoint compromise, triggered simply by loading…. A patch is available.

| CVE-2026-95350 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-09-23 vendor:ubuntu

GHSA-5c74-fmf8-h398

Buffer Overflow Chrome Google Heap Overflow Red Hat Suse

9.6

CVSS 3.1 · Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Victim visits attacker-controlled page
Delivery

Malicious content processed by Chrome
Exploit

Trigger heap buffer overflow
Execution

Corrupt heap and hijack control flow
Persist

Execute code / escape sandbox (scope change)
Impact

Compromise browser and host data

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to load attacker-controlled web content in Google Chrome (UI:R - visiting a malicious page or interacting with malicious embedded content such as a page, iframe, or ad). No authentication is required (PR:N) and the attack is remote (AV:N) with low complexity (AC:L). The primary limiting factor is the required user interaction of navigating to or rendering hostile content; the fix is delivered by updating Chrome to the patched Sept 2026 stable desktop release, so unpatched, actively-browsing endpoints are the realistic exposure. The exact triggering feature/component is not specified because the CVE description is unavailable.
Impact	This is a genuine high priority. The CVSS 9.6 is driven by a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) heap overflow (CWE-122) in Google Chrome that produces a scope change (S:C) with full C:H/I:H/A:H impact - the classic browser-renderer-to-RCE/sandbox-escape profile. The only mitigating base-metric is UI:R (the victim must visit or interact with attacker content), which is trivially satisfied for a web browser. No EPSS score, KEV listing, or public POC was provided, so there is NO evidence of active exploitation or weaponization at this time; the severity rests on impact and reachability, not on observed attacks. One data conflict to flag: the description is UNKNOWN/[Unknown description], so the specific vulnerable component (renderer, GPU, V8, etc.) cannot be confirmed - the CWE-122 heap overflow and 9.6 vector are the only technical anchors, corroborated by the Chrome release blog and chromium issue 551573368. Given Chrome's ubiquity and its history of these bugs being rapidly reverse-engineered from patches, defenders should treat this as urgent-patch despite the absence of a current POC/KEV signal.
Exploit ScenarioDerived	An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) that triggers a heap buffer overflow in Chrome when the victim browses to it. Successful exploitation corrupts heap memory to achieve arbitrary code execution, and the scope change (S:C) indicates the impact can escape the originally-vulnerable component into the broader browser/host context. No public exploit code was identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 29, 2026

Heap-based buffer overflow in Google Chrome desktop (stable channel) allows a remote, unauthenticated attacker to corrupt heap memory when a victim renders attacker-controlled web content such as a malicious page, iframe, or ad, yielding high impact to confidentiality, integrity, and availability with a changed scope that suggests effects can extend beyond the initially affected component. Exploitation requires user interaction (UI:R) - the victim must load the hostile content - but needs no credentials (PR:N), is network-reachable (AV:N) and low complexity (AC:L), making actively browsing, unpatched endpoints the realistic exposure. No public exploit has been identified at time of analysis; the referenced Chrome stable channel advisory and Chromium issue 551573368 confirm a vendor fix, and the independent assessment rates this a genuine high priority at CVSS 9.6.

Earlier versions of this analysis (1)

v1 Sep 24, 2026 - 02:18

Risk cannot be quantified from the available signals because the core metadata is absent: there is no CVSS base score or vector, no CWE, no EPSS probability, no SSVC decision data, and no CISA KEV listing for CVE-2026-95350. What is confirmed is that the affected product is Google Chrome on the desktop stable channel and that the vendor has published a stable-channel update addressing it (referenced via the Chrome Releases blog and reported to intelligence sources by vendor:ubuntu). No public exploit code has been identified at time of analysis, and the specific impact, attack vector, privileges required, and user-interaction requirements cannot be determined from the provided data; exposure is effectively bounded to hosts that have not yet applied the Chrome auto-update.

RemediationAI

Patch available per vendor advisory: update Google Chrome to the fixed release published in the September 2026 stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, then fully restart the browser so the new binary is loaded - an exact fixed version string is not provided in the available data and should be read from the advisory. Ubuntu-packaged deployments should apply the corresponding distro update and confirm the resulting binary version. Where immediate patching is not feasible, compensating controls carry real trade-offs: enforce browser auto-update via enterprise policy and verify the running version (chrome://version), accepting that this only helps on managed endpoints; confine browsing of untrusted or high-risk content to a disposable VM or isolated remote-browsing environment, which reduces the blast radius but adds latency and management overhead; and restrict unpatched browsers from accessing sensitive internal applications and credential stores at the network/identity layer, which limits post-exploitation value at the cost of user convenience. Because this is a memory-corruption bug with a changed-scope vector, rely on Chrome's process isolation and keep the sandbox enabled - disabling it to troubleshoot would materially worsen exposure.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is classified as CWE-122 (heap-based buffer overflow), a memory-safety class in which a heap-allocated buffer is written or read past its intended bounds because of missing or incorrect length validation, typically producing memory corruption that can be steered toward code execution or at minimum a reliable crash. In a browser context this class of bug lives in the parsing, rendering, media, or JavaScript-engine layers that process untrusted web content, and the CVSS vector's S:C (scope changed) indicates the impact can cross a security boundary beyond the vulnerable component itself - relevant to Chrome's multi-process, sandboxed architecture where a renderer compromise is only the first stage. The vector AV:N/AC:L/PR:N/UI:R describes a remote, low-complexity attack requiring no privileges but succeeding only when the victim loads attacker-controlled content. The exact triggering feature or component is not specified because the CVE description is unavailable; Chromium issue 551573368 and the September 2026 stable channel advisory are the authoritative sources for the patched component. The deploying distribution flagged by the reporter (vendor:ubuntu) indicates downstream Linux packaging is also tracked for this CVE.

Know when Chrome gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 9.6 CRITICAL

Remote malicious page (AV:N/AC:L/PR:N) needs only the user to browse (UI:R); a heap-overflow RCE that escapes the renderer sandbox yields S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE CRITICAL

Red Hat 9.6 HIGH

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Sep 23, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

Executive ViewAI

Why It Matters

A critical memory-corruption vulnerability in Google Chrome desktop exposes any employee who browses the web on an unpatched machine to potential full endpoint compromise, triggered simply by loading attacker-controlled content such as a malicious page, iframe, or advertisement - no credentials are required. Because Chrome is the default browser for most of the workforce and the flaw's changed scope means effects can extend beyond the browser process itself, a successful attack could lead to loss of sensitive data, disruption of business operations, and broader host compromise. A vendor fix is already available, so the organization's real exposure is the deployment gap between patch release and fleet-wide update.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Prevalence

Ubiquitous

Google Chrome is the dominant web browser across consumer and enterprise environments

Data Quality

3 sources

Confidence: Low

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.