EUVD-2026-89243Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryDeliver crafted content to vulnerable component
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt renderer memory
-
ImpactExecute attacker-controlled code in renderer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome to load attacker-controlled web content (UI:R - user interaction via navigating to or rendering a malicious page); no authentication or prior privileges are needed (PR:N) and the attack is network-delivered with low complexity (AV:N/AC:L). Limiting factors: the user must actually visit or be redirected to the malicious page, and because the vector is scope-unchanged (S:U) the memory corruption is expected to remain within the renderer/browser process without an inherent cross-boundary escape, so full host compromise would require chaining an additional sandbox-escape bug. Patched Chrome builds are not affected. |
| Impact | This is a genuine high-priority issue: the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity memory-corruption flaw (CWE-787 out-of-bounds write) in Google Chrome requiring only that a user visit a malicious page (UI:R). Unlike its sibling Chrome CVEs from this same September 2026 stable update (e.g. CVE-2026-95350/95329/95357, all 9.6 with S:C), this one is scored scope-unchanged (S:U), which lowers the base to 8.8 - consistent with corruption confined to the renderer sandbox rather than crossing a trust boundary. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'; treat the 8.8 as a patch-urgency signal driven by product ubiquity and low attack complexity rather than by evidence of active exploitation. A key data gap: the description is '[Unknown description]', so the specific Chrome component and the C:H/I:H/A:H impacts are inferred from the CVSS vector and the CWE-787 classification, not from a narrative - verify the affected component via the linked Chromium issue. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing content that triggers the out-of-bounds write when rendered by Chrome, then lures a victim to visit it (UI:R). Successful corruption of renderer memory can lead to arbitrary code execution within the browser process, the classic precursor to a sandbox-escape chain. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Out-of-bounds memory write in Google Chrome (desktop builds) lets remote, unauthenticated attackers corrupt browser memory when a victim loads attacker-controlled web content. The vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with C:H/I:H/A:H (base 8.8), so the only prerequisite is that a user navigates to or renders a malicious page, and because the vector is scope-unchanged the memory corruption is expected to remain within the renderer/browser process rather than granting an inherent sandbox escape. The underlying flaw is an out-of-bounds write (CWE-787) in Chrome builds predating the vendor's September 2026 stable channel fix; patched builds are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Earlier versions of this analysis (1)
The Ubuntu vendor security feed is the only source reporting CVE-2026-95304, and the record carries no description, no CVSS vector, no CWE mapping, and no identified affected package, so the impact on any Ubuntu system cannot be characterized at this time. Because the vulnerable component, the access path, and any authentication prerequisite are all unknown, there is no basis to state whether this is remote or local, whether privileges are required, or whether user interaction is needed; no CVSS score or vector is present to indicate a network or local attack surface. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, but this reflects the absence of data rather than a verified negative finding. Risk cannot be meaningfully assessed from the provided data, and this entry should be treated as an unactionable placeholder until Ubuntu publishes a security notice or CVE tracker entry describing the affected package and version.
RemediationAI
Patch status: vendor-released patch available - apply the Chrome stable channel update from September 2026 as documented at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, which lists the exact fixed version; the upstream fix is also tracked at https://issues.chromium.org/issues/560536731. Ubuntu and Debian-derived users should update their Chrome/Chromium packages through the normal package channel (apt/snap) so the vendor-supplied build replaces the vulnerable one, and enterprises should enforce auto-update or use version-pinning policies to confirm the fixed build is deployed. Until every endpoint is patched, the most effective compensating control is to keep Chrome's process sandbox and site isolation fully enabled - never launch with --no-sandbox or disable site isolation, since an intact sandbox is what keeps this scope-unchanged memory corruption from becoming host compromise, though the trade-off is that some legacy in-house or plugin-dependent pages may render differently under strict isolation. Additional risk reduction includes URL/IP blocklisting and proxy filtering of untrusted or low-reputation sites to reduce the chance a user reaches a malicious page (trade-off: breaks legitimate browsing to blocked destinations and requires ongoing list maintenance), and routing high-risk browsing through a disposable VM or remote browser isolation service (trade-off: added latency and operational cost). Because exploitation requires the victim to load attacker content, hardening navigation and email/web-gateway links against redirects provides meaningful interim protection; no public exploit code or active exploitation was identified at time of analysis, so patch deployment is not currently crisis-urgent but remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, which in Chrome's multi-process architecture surfaces as memory corruption (the intelligence tags it as both 'Buffer Overflow' and 'Memory Corruption') inside the renderer that parses attacker-supplied web content. The assessed vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H means the bug is reachable over the network without credentials or privileges and without a race or other complexity barrier, but it does require user interaction (UI:R) - the victim must actually navigate to, or be redirected into, attacker-controlled content. Because the scope is unchanged (S:U), the corruption is expected to be contained to the compromised process, so converting it into full host compromise would require chaining an additional sandbox-escape vulnerability; Chrome's site isolation and sandbox are therefore the key secondary defenses. The vulnerabilities were fixed in the Chrome stable channel update referenced at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, with the underlying engineering detail tracked in Chromium issue 560536731 (https://issues.chromium.org/issues/560536731), and the issue was surfaced through the Ubuntu vendor tracking channel, indicating that Chromium/Chrome packages shipped through Ubuntu are also in scope.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious page needing only user navigation (UI:R, PR:N, AC:L); out-of-bounds write yields memory-corruption RCE potential within the renderer, so C/I/A:H and S:U.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome on enterprise desktops carries a high-severity out-of-bounds memory write (CVE-2026-95304) that a remote, unauthenticated attacker can trigger simply by getting an employee to open a malicious web page. Because Chrome is broadly deployed and routinely allowed to render untrusted internet content, any endpoint still running a pre-September 2026 build represents an organization-wide exposure rather than an isolated technical issue. The flaw appears contained to the browser's renderer process with no demonstrated sandbox escape, so the near-term business risk is session disruption and the staff time required to inventory, patch, and verify a very large endpoint population.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
GitHub PoC
Exploit-DB