EUVD-2026-89222
GHSA-7pgj-w3x2-q4qf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
DeliveryLure Chrome user to visit
-
ExploitTrigger missing authorization check
-
ExecutionCross security boundary
-
ImpactRead sensitive data and alter state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running Google Chrome earlier than 154.0.8037.57 to interact by navigating to or rendering attacker-controlled web content (UI:R); no authentication or prior privileges are needed (PR:N) and the attack is delivered over the network (AV:N) against default browser configurations. The limiting factor is the mandatory user interaction - the victim must open the malicious page - and the fact that patched builds (154.0.8037.57 and later) are not affected; the exact triggering feature cannot be named because the CVE description is unavailable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (UI:R) - consistent with a browser bug triggered when a victim visits attacker-controlled web content in Google Chrome. There is no CISA KEV listing and no public exploit code referenced, so the correct exploitation status is 'no public exploit identified at time of analysis'; EPSS and SSVC data were not provided. The strong confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N) points to data disclosure and/or state corruption within the renderer/browser rather than a crash, though the actual technical mechanism cannot be confirmed because the description is '[Unknown description]'. The CWE-862 (Missing Authorization) classification conflicts with the input Tag 'Authentication Bypass' and with typical Chrome stable-channel bug taxonomy - the underlying flaw is a missing/insufficient authorization or permission-boundary check, not credential bypass; this discrepancy should be verified against the Chromium issue tracker entry. Net: this is a genuinely broad-exposure browser patch worth prioritizing due to ubiquity and unauthenticated network vector, but it is not confirmed as actively exploited, so it ranks as important-patch rather than emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious or compromised web page and lures a Chrome user (version below 154.0.8037.57) to visit it. When the page loads, the missing authorization check is triggered, allowing the attacker's content to read sensitive data across a security boundary and tamper with browser/page state (C:H/I:H) without the user granting any special permission. No authentication is required and no public exploit code is currently known, but user interaction (navigating to the page) is necessary. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Missing authorization enforcement in Google Chrome builds earlier than 154.0.8037.57 (classified CWE-862 and tagged as an authentication bypass) lets an attacker defeat an access-control decision in the browser, with the impact scored as high confidentiality and high integrity loss (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The flaw is network-delivered and requires no authentication or prior privileges, but exploitation is not silent: the victim must navigate to or render attacker-controlled web content (UI:R), which keeps the practical attack path dependent on user browsing behavior rather than on a remotely reachable service. Google has shipped the fix in Chrome 154.0.8037.57 and the issue is tracked as ENISA EUVD-2026-89222 / Chromium issue 540265100; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.
Earlier versions of this analysis (1)
Ubuntu is the only identified locus of CVE-2026-95301, an entry surfaced through the Ubuntu vendor reporting channel for which no description, CVSS vector, CWE classification, affected package, or version range has been published, leaving the security impact entirely undefined. Because attack vector, privilege requirements, and user-interaction prerequisites are all unknown, defenders cannot tell whether the issue is remotely reachable, locally triggered, or confined to a specific package, service, or configuration. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, but that reflects missing data rather than a verified negative; EPSS scoring is likewise unavailable, so the entry should be treated as unscoped until Ubuntu publishes advisory detail.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 154.0.8037.57 or later, as documented in the September 2026 stable channel advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, mirrored at https://nvd.nist.gov/vuln/detail/CVE-2026-95301), and verify the installed build at chrome://version after restarting the browser so the update actually takes effect. The patch is described as available from the vendor and the reporting source is vendor:ubuntu, so Ubuntu-packaged Chromium/Chrome builds should be refreshed through the distribution's normal channel once the corresponding package is published; enterprise fleets can force the update with Chrome Browser Cloud Management or the appropriate update policy and should audit for long-lived pinned or frozen builds. Where immediate upgrading is not possible, treat the flaw as a user-interaction-dependent browser boundary failure and apply specific compensating controls with acknowledged trade-offs: restrict browsing to allow-listed sites through enterprise URL allow/block policy (effective against drive-by delivery but breaks general web access and generates helpdesk load), disable the Chrome JIT with --js-flags=--jitless to reduce the reliability of renderer-level exploitation (degrades JavaScript performance noticeably and can break complex web applications), and keep Site Isolation and any sandbox hardening enabled while removing unnecessary extensions and privileged internal pages from reach. Do not rely on network-perimeter blocking, since the trigger arrives as ordinary web content, and note that because exploitation requires the victim to open the malicious page (UI:R), user awareness combined with update enforcement is the highest-value control until all endpoints are on 154.0.8037.57 or later. No public exploit code exists at time of analysis and the CVE is not in CISA KEV, so these mitigations are precautionary rather than incident-driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization), reinforced by the intelligence tag 'Authentication Bypass': the browser fails to verify that the requester is entitled to perform an action or reach a resource, so a security boundary that Chrome intends to enforce is not enforced. In a browser context this typically means a permission, origin, or privileged-interface check inside the multi-process architecture (browser process, renderer, utility/network services) is skipped, allowing content that should be constrained to reach a capability it should not. The assessed CVSS vector is consistent with that reading: AV:N with AC:L and PR:N indicates remotely reachable, low-complexity triggering with no credentials, while UI:R places the trigger inside a page the victim opens, matching a browser bug fired by attacker-controlled web content rather than an unauthenticated network service. Notably the vector carries C:H and I:H but A:N, and combined with CWE-862 this points to an authorization/logic failure with data disclosure and modification potential rather than a memory-safety crash primitive; that is an inference from the vector and CWE and should be treated as such, since the CVE description was not available and the underlying Chromium issue is not publicly detailed. No CPE string was supplied in the source data; the authoritative version scope comes from ENISA EUVD, which lists the affected range as Chrome earlier than 154.0.8037.57, with 154.0.8037.57 as the fixed baseline. Google's standard practice of withholding technical detail from the stable-channel advisory until most users have updated (advisory at chromereleases.googleblog.com, September 2026 stable channel update) explains the thin public description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-delivered browser flaw needing victim navigation (UI:R) but no auth (PR:N); missing authorization yields high confidentiality/integrity, no availability impact, scope unchanged.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome versions prior to 154.0.8037.57 contain a high-severity authorization bypass that could allow attackers to compromise the confidentiality and integrity of data processed within the browser. Organizations relying on unpatched Chrome are at risk because exploitation, while requiring a user to visit malicious web content, can lead to unauthorized access to sensitive information and manipulation of browser-based sessions. Leadership should act promptly given Chrome's widespread use and the availability of a vendor fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB