EUVD-2026-89216
GHSA-vmfp-fv77-hfjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted web content
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionCorrupt renderer heap memory
-
ImpactAchieve code execution / cross-boundary impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to interact with attacker-controlled web content (UI:R) - typically visiting a malicious page or rendering hostile content such as a malicious ad in a vulnerable Chrome build. The trigger is remote and unauthenticated (AV:N/PR:N) against default Chrome configurations, so no special browser setting is needed, but the mandatory user interaction and Chrome's automatic-update mechanism (which rapidly closes the window once a stable-channel update is applied) are the primary limiting factors. Exact vulnerable versions are not specified in the provided data beyond the September 2026 stable-channel update. |
| Impact | The CVSS 3.1 base score of 9.6 is Critical, driven by network attack vector (AV:N), low complexity (AC:L), no privileges (PR:N), and a scope change (S:C) with full C:H/I:H/A:H impact - the classic profile of a renderer heap corruption (CWE-122) leading to sandbox-relevant compromise via a malicious web page. However, exploitation is gated by user interaction (UI:R), meaning the victim must visit or interact with attacker-controlled content, which meaningfully tempers the 'critical' rating in practice. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable mass-exploitation at this time: this reads as a high-severity-by-impact browser bug rather than a confirmed in-the-wild threat. One conflict to flag: the description is entirely absent ('[Unknown description]'), so the specific vulnerable component and root cause cannot be confirmed - the analysis is inferred from the Chromium references, CWE-122, and the tags. Because Chrome auto-updates and a vendor patch is already available, real-world exposure decays quickly once users restart; prioritize patch rollout but treat active-exploitation claims as unverified. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content via an ad or compromised site) that triggers a heap buffer overflow in Google Chrome when rendered. A victim who visits the page with a vulnerable Chrome version has the corrupted heap leveraged for memory corruption, potentially escaping normal renderer boundaries given the scope change. No public POC or exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Heap-based buffer overflow (CWE-122) in Google Chrome's stable channel, addressed in the September 2026 desktop stable-channel update, lets remote, unauthenticated attackers corrupt heap memory in a vulnerable build and potentially escape the browser's renderer sandbox for full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.6, S:C). Exploitation requires the victim to interact with attacker-controlled web content - typically visiting a malicious page or rendering a hostile ad - so the practical window depends on how quickly users and Linux distributions apply the update. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; details remain limited because the referenced Chromium issue tracker entry is access-restricted.
Earlier versions of this analysis (1)
Security defect in Google Chrome on the desktop stable channel has been addressed by a vendor-released stable-channel update, so exposure is limited to installations that have not yet applied the current build. The vulnerability description is withheld and no CVSS score or vector, CWE, EPSS probability, or CISA KEV entry is available, so the exact attacker capability and prerequisites cannot be confirmed; authentication requirements are not confirmed from available data, and no public exploit code was identified at time of analysis. Based on the normal browser threat model, exploitation most plausibly requires a victim to load attacker-controlled web content, but this remains unconfirmed.
RemediationAI
Vendor-released patch: the fix is included in the September 2026 Chrome desktop stable-channel update (advisory: http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html); because Chrome's automatic updater normally applies this within days, the primary action is to verify the installed version via chrome://settings/help (or chrome://version) and relaunch the browser so the pending update takes effect. Ubuntu and other distributions that build Chromium from source must be updated to the vendor's patched package rather than relying on the browser's own updater. Until the update is confirmed applied, the most effective compensating control is to constrain exposure to untrusted content: only the mandatory user-interaction step in the attack chain (UI:R) can be interrupted, so restricting browsing of untrusted sites to a fully patched browser, a separate patched browser profile, or a strictly isolated sandboxed environment meaningfully reduces risk, at the cost of usability. If enterprise policy delays updates, verify that Site Isolation remains enabled (it is a key backstop against renderer bugs of this class; disabling it for compatibility or performance reasons removes that layer), and keep any command-line flags that weaken the sandbox or enable unsupported renderer features turned off. Blocking or filtering ad and third-party content at the network layer removes one realistic delivery vector but is not a substitute for patching, and there is no reliable way to filter a specific CWE-122 trigger. No proof-of-concept details are available, and the restricted Chromium issue means version-specific technical mitigations cannot be derived from the public record.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122): a memory-safety defect in which a size or index computation performed on the native heap allows a write or read beyond an allocated buffer. In Chrome's multi-process architecture this class of bug typically sits in the renderer - the sandboxed process that parses and executes untrusted web content (Blink rendering, DOM, WebAssembly/JIT, image and media decoders, or graphics/Skia paths) - and is reached simply by getting the browser to process a crafted page or embedded resource. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H vector describes a network-delivered, low-complexity, unauthenticated attack that nonetheless requires user interaction (UI:R), which the independent assessment attributes to the victim loading attacker-controlled web content. The scope change (S:C) and full C/I/A impact are consistent with a renderer heap corruption that escalates beyond the vulnerable component's own security authority - i.e., a sandbox escape or equivalent cross-boundary compromise rather than mere crash or tab-level denial of service. The advisory reference is Google's stable-channel release note and the second reference is the restricted Chromium bug tracker entry (issues.chromium.org/553172761), which is standard for Chrome security fixes withheld until most of the user base has updated. CWE-122 leaves open the exact subcomponent; the provided data does not name the affected library or the precise overflow primitive.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote malicious page requires no privileges but needs user interaction (UI:R); a renderer heap overflow with scope change yields full C/I/A impact.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
A critical heap overflow in Google Chrome's desktop stable channel could allow remote attackers to escape the browser sandbox and fully compromise affected systems, affecting all users of vulnerable Chrome versions. No public exploit identified at time of analysis, but the vulnerability's severity and Chrome's widespread deployment mean that a successful attack could lead to data theft, malware installation, or unauthorized access to sensitive information. Leadership should prioritize rapid patching to mitigate potential operational and reputational damage.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB