EUVD-2026-89232
GHSA-c4qc-cmcv-4jwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
DeliveryVictim visits page in vulnerable Chrome
-
ExploitTrigger use-after-free in renderer
-
ExecutionCorrupt reused object memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome build (any version below 154.0.8037.57) and to navigate to attacker-controlled web content (UI:R) - a malicious page, or attacker content embedded in a trusted site. No authentication, privileges, or non-default configuration is needed (PR:N). Limiting factors: the required user interaction (loading the page), the fact that impact is initially confined to the renderer sandbox (S:U) so a separate sandbox-escape is needed for host takeover, and that patched builds are already distributed via Chrome's auto-update, shrinking the window on kept-current fleets. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity use-after-free (CWE-416) requiring only that a victim visit a malicious page (UI:R), with no authentication or privileges needed. This is a genuine drive-by RCE-class flaw in Chrome, the browser engine class most heavily targeted by exploit brokers. However, several exploitation signals are ABSENT from the input: no EPSS probability is provided, the vulnerability is NOT on the CISA KEV list, and no public POC is referenced - so at this time it is 'no public exploit identified.' The scope is unchanged (S:U), meaning code execution is initially contained in the renderer sandbox and would need to be chained with a sandbox-escape bug for full host compromise, which tempers the raw 8.8 relative to scope-change (S:C) Chrome siblings. Net assessment: a high-priority patch-now issue given ubiquitous deployment and memory-corruption class, but there is no evidence of active or automated exploitation yet, so it is priority-by-prevalence rather than priority-by-confirmed-exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or compromises an ad/iframe on a legitimate site) that triggers the use-after-free when a victim running a pre-154.0.8037.57 Chrome build loads it. The freed-then-reused object gives the attacker a memory-corruption primitive leading to arbitrary code execution within the renderer process; full system compromise would require chaining a separate sandbox escape. No public exploit code is currently identified for this specific CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 29, 2026
Use-after-free memory corruption in Google Chrome builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory and potentially execute code within the browser renderer by persuading a victim to load attacker-controlled web content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Exploitation requires the victim to open a malicious page or attacker-embedded content in a trusted site, and because the assessed scope is unchanged (S:U) the impact is initially confined to the renderer sandbox, so full host takeover would require a separate sandbox escape; Google has shipped a fixed build that is distributed through Chrome auto-update, shrinking the exposure window on kept-current fleets.
Earlier versions of this analysis (2)
Use-after-free memory corruption in Google Chrome desktop builds older than 154.0.8037.57 lets a remote attacker who convinces a victim to render attacker-controlled web content potentially execute code inside the browser's renderer process, affecting confidentiality, integrity and availability at a high level (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior access is required, but exploitation hinges on user interaction - the victim must load a crafted page - and the assessed impact is confined to the renderer, so a separate sandbox escape would be needed to compromise the host. At the time of analysis there is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code has been identified, so the strongest risk signals are the high CVSS vector and the memory-corruption class rather than observed attacks.
CVE-2026-95282 is a currently undocumented security flaw in Ubuntu Linux, recorded in this dataset only because the Ubuntu security team is the reporting source (vendor:ubuntu). No description, CVE record, CVSS score, CVSS vector, CWE classification, or affected-version range accompanies the identifier, so the impact an attacker could achieve and the components involved are not confirmed from available data. There is no indication of active exploitation (the CVE is not in CISA KEV) and no public exploit code has been identified at time of analysis; per the independent assessment, risk cannot be meaningfully assessed until the Ubuntu Security Notice and NVD record are retrieved.
RemediationAI
Vendor-released patch: Google Chrome 154.0.8037.57 (September 2026 stable channel update, per chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html). The primary action is to upgrade every Chrome instance to 154.0.8037.57 or later and fully restart the browser so the new build is loaded, since auto-update can stage a fix without the running process picking it up; fleets that pin browser versions should be updated through their management tooling, and Ubuntu/Debian users should install the refreshed chromium/chrome package from their vendor. Where immediate upgrading is not possible, there is no reliable configuration switch that eliminates the bug, so the practical compensating controls are to keep the renderer sandbox enabled (never launch with --no-sandbox or equivalent flags, which would remove the main barrier to host takeover given the S:U scope), keep site isolation and the standard sandboxing defaults in force, and reduce exposure by restricting browsing of untrusted web content through network/proxy allow-listing or high-risk user segmentation - all of which lower the probability of encountering a trigger page but carry the trade-off of limiting legitimate browsing and still leaving a kept-current-free window open. Verify the patched build via the browser's version page and confirm no long-lived or embedded browser sessions are left on the vulnerable version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Google Chrome, a class of memory-safety bug in which an object is freed while references to it remain live, so a later dereference reads or writes memory that may have been reused. In a Chromium-based browser this typically sits in the C++ rendering or DOM/JavaScript engine and manifests with the accompanying tags of memory corruption and information disclosure, since a dangling pointer can both leak heap contents and enable attacker-influenced writes. The assessed vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the bug is triggered over the network with low complexity and no credentials, but requires victim interaction (UI:R) - loading attacker-controlled web content, whether a malicious page or injected content on a legitimate site - and, per the unchanged scope rating, corrupts only the renderer process rather than crossing a trust boundary by itself. EUVD tracks this as EUVD-2026-89232 against the Chrome 154.0.8037.57 build level, and the upstream Chromium issue (issues.chromium.org/553129513) is the primary technical record.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable UAF triggered by visiting a malicious page (UI:R), no privileges (PR:N), low complexity, renderer-scoped (S:U) with full RCE-class C/I/A impact.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome versions prior to 154.0.8037.57 contain a use-after-free memory corruption flaw that a remote, unauthenticated attacker can trigger against any employee who simply browses to attacker-controlled or attacker-embedded web content. Because Chrome is deployed broadly across the workforce and the flaw affects memory handling in the browser renderer, a successful compromise could hand an adversary code execution on the endpoint, making this a material risk to endpoint integrity and any sensitive data accessible from the browser. The vulnerability carries a CVSS score of 8.8 and a vendor fix already exists, so organizational exposure is largely a function of how quickly the fleet is brought current.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB