EUVD-2026-89219
GHSA-qg7h-rh3g-vpwq
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine high-priority issue despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated CWE-787 out-of-bounds write in Google Chrome that requires only user interaction (visiting a malicious page) and produces a scope change (S:C) with full confidentiality, integrity, and availability impact - the classic renderer-memory-corruption-to-RCE / sandbox-escape profile. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'; do not read the missing signals as low risk. Chrome memory-corruption bugs of this class are historically among the most rapidly weaponized once details surface, and Google's terse advisory model means public technical detail (and thus POC/EPSS movement) typically lags the fix. The one notable conflict: the description is '[Unknown description]', so the specific vulnerable component and the exact nature of the S:C scope change are inferred from the CWE, CVSS vector, and Chrome's advisory pattern rather than confirmed from vendor text - verify the affected component against chromium issue 559320837 when access is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
An out-of-bounds memory write in Google Chrome allows an unauthenticated, remote attacker to corrupt memory and potentially execute arbitrary code or crash the browser when a victim opens a crafted web page, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6, scope-changed). The flaw is classified as CWE-787 (out-of-bounds write) and is addressed by the vendor's stable channel update for desktop, with the fix credits originating from the Ubuntu vendor reporting channel, meaning downstream Chromium packages are also in scope. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS data provided; however, because browser memory-corruption bugs of this class are historically attractive to exploit developers, this remains a high-priority patching item despite the absence of exploitation telemetry.
Earlier versions of this analysis (1)
Google Chrome for desktop must be updated to the September 2026 stable-channel release to close a security defect whose description, severity score, and weakness class were not included in the available intelligence, so the precise impact cannot be characterized from this data alone. Affected users are those running a pre-patch desktop Chrome build, and the most plausible exploitation path is a victim rendering attacker-controlled web content, which implies user interaction rather than a purely remote, no-interaction attack. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS score is available; the vendor-supplied stable-channel update fully limits exposure once applied, and Chrome's default auto-update mechanism substantially narrows the real-world window of risk.
RemediationAI
Vendor-released patch: Chrome stable channel update published in https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html (exact version string is not included in the provided data and must be read from the advisory). Update immediately by opening chrome://settings/help to force a stable-channel update and relaunching the browser, or by upgrading the distribution package (for example, refreshing the Ubuntu chromium-browser snap or applying the corresponding Ubuntu security update) and verifying with the browser's version/about page. If the patched build cannot be deployed at once, compensating controls have real trade-offs: enforce enterprise policy that keeps Site Isolation enabled and prevents users from disabling it (reduces cross-site data exposure from a renderer compromise but does not stop the memory-corruption write itself); restrict high-risk browsing by blocking untrusted or user-supplied HTML content at the network/proxy layer and disabling unnecessary plug-in and file-preview surfaces for untrusted content (reduces attack surface but breaks legitimate workflows); and, as a last resort on tightly controlled endpoints, launching Chrome with JavaScript JIT disabled (--js-flags="--jitless") removes a common memory-corruption attack surface but causes severe page-performance regressions and breaks some web applications, so it should only be used for high-value, browsing-restricted hosts until patching is complete. Monitor the Chrome Releases blog and the Chromium issue tracker (https://issues.chromium.org/issues/559320837) for any revised advisory details or exploited-in-the-wild confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-787, an out-of-bounds write, meaning code writes data past the end of an allocated buffer, corrupting adjacent heap or object memory; the tags 'Buffer Overflow' and 'Memory Corruption' corroborate this classification. The CVSS vector - network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed with high confidentiality, integrity, and availability impact - is consistent with a memory-safety bug reachable through web content rendered by the Chromium multi-process engine, where a crafted page drives the write inside a renderer process and the scope-changed metric signals impact that can cross a security boundary beyond the immediately vulnerable component. The specific subsystem is not disclosed in the supplied data (the upstream Chromium issue at issues.chromium.org/issues/559320837 is referenced but no component detail, memory region, or proof-of-concept is available), so no claim is made about whether the affected code resides in the JavaScript engine, graphics stack, or another component. Chromium's architecture - per-renderer sandboxing, Site Isolation, and a separate browser process - is the principal defense-in-depth barrier that limits whether such a corruption bug can escalate from a renderer compromise to full browser or host compromise, which is why the scope-changed rating makes this more serious than a plain renderer crash. The report attribution to vendor:ubuntu indicates the defect is tracked and patched in the upstream Chromium project and propagated to distributions that package Chromium, such as Ubuntu.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome users across the organization are at risk from a critical memory corruption vulnerability (CVE-2026-95329) that could allow unauthenticated remote attackers to execute arbitrary code or crash browsers when users visit a malicious web page. This flaw requires only that a user open a crafted page, and successful exploitation could lead to data theft, system compromise, and operational disruption. Given the critical severity and historical targeting of browser memory bugs, leadership should prioritize immediate patching to protect sensitive data and maintain business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB