EUVD-2026-89253
GHSA-hhrw-m3wm-6g66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitBrowser renders attacker-controlled content
-
ExecutionTrigger flaw in Chrome component
-
ImpactImpact on user's browser (unconfirmed - no CVSS/description)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be enumerated concretely because the description is empty and no CVSS vector is provided. Based on the Chrome desktop stable-channel advisory context, exploitation most plausibly requires the victim to run desktop Chrome and to render attacker-controlled web content, but the exact required feature, configuration, or user interaction is NOT stated in the available data and must be verified against the Chrome Releases advisory and NVD once populated. Limiting factors are unconfirmed; authentication requirements cannot be confirmed from available data because no CVSS vector is present. |
| Impact | This CVE is a near-total data void from a scoring standpoint: no description, no CVSS score or vector, no CWE, no EPSS probability, no CISA KEV listing, and no public POC are present in the input. The ONLY substantive signal is the single reference - a Google Chrome 'Stable Channel Update for Desktop' advisory (chromereleases.googleblog.com, Sep-2026) - plus a note that a vendor patch is available and that the issue was reported via vendor:ubuntu (Ubuntu's downstream tracking of the upstream Chromium fix). Because the CVSS vector is entirely absent, attack vector, complexity, privileges, and impact CANNOT be determined from the data provided and must NOT be inferred. There is no evidence of active exploitation (KEV=NO) and no public exploit code (POC=NO), so no public exploit is identified at time of analysis. Real-world risk should be treated as UNRESOLVED-but-patch-worthy: Chrome browser flaws in this class are historically high-value once details/exploits emerge, and the affected product is ubiquitous, so the recommended posture is prompt patching on the strength of the vendor-released fix even though the severity signals here are missing. Conflict/missing-data note: severity is entirely unquantified in this feed - the CVSS/CWE/EPSS gaps must be resolved against the Chrome Releases advisory and NVD before any priority ranking. |
| Exploit ScenarioDerived | Because no technical description is available, the concrete mechanism is unknown; based only on the Chrome stable-desktop advisory context, a typical scenario would involve a victim using desktop Chrome navigating to or rendering attacker-controlled web content that triggers the flaw in the browser. No public proof-of-concept exists in the provided data, and the specific attack vector and complexity cannot be confirmed because no CVSS vector was supplied. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop stable-channel builds are covered by a vendor security update that addresses CVE-2026-95375, a defect for which no description, CVSS score or vector, CWE mapping, EPSS probability, or CISA KEV entry is present in the available intelligence. Because the record is essentially a data void, the concrete attack impact, the prerequisite configuration, and the required user interaction cannot be confirmed from the supplied data; the only reliable signal is that Google published a Stable Channel update for Desktop (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html) and that the Ubuntu security team is tracking the CVE against its Chromium packaging, which indicates a Linux distribution impact in addition to the upstream browser. No public exploit code exists in the provided data (no POC reference, no KEV listing), so exploitation status is assessed as no public exploit identified at time of analysis, and no EPSS-based likelihood estimate can be cited. Treat this entry as patch-now hygiene rather than as a demonstrated emergency until NVD and the Chrome Releases advisory are populated with the affected component and severity.
RemediationAI
Patch status is patch available per vendor advisory, but the input does not include an exact fixed version number, so no version should be quoted; the authoritative fix is the Chrome desktop Stable Channel update described at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html, and administrators should apply the Chromium or Chrome build listed there and verify the installed version matches or exceeds it. On managed Windows, macOS, and Linux fleets, force a browser update check and restart, since Chrome generally completes the update only after all browser processes are restarted; on Ubuntu and other distributions that package Chromium, apply the corresponding package upgrade through the normal archive once the distribution advisory lands. Because the flaw's specifics are unknown, no targeted configuration workaround can be recommended as a substitute for patching, and inventing one would be speculative; the only defensible interim controls are generic reductions in browser attack surface such as keeping the browser on the managed update channel, restricting untrusted web content for high-risk user populations through existing proxy or policy controls, and ensuring endpoint detection coverage for browser process compromise. Those interim controls carry real trade-offs: blocking or restricting web content degrades user productivity and may break line-of-business applications, and they do not remediate an already-patched-available flaw, so they should be treated strictly as temporary measures until the fixed build is deployed everywhere. There is no vendor-released patch for any non-Chrome product implicated by this CVE in the supplied data, and absence of further detail in this record is not confirmation that no other remediation path exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The available data contains no CWE, no CPE strings, and no CVSS vector, so the root-cause class (for example memory-safety corruption, type confusion, use-after-free, or an insufficient-validation logic flaw in Blink, V8, or a browser service) cannot be determined and must not be assumed. What can be established structurally is the delivery context: the sole advisory reference is Google's Stable Channel update for Desktop, the canonical channel through which Chrome fixes are shipped to end users on Windows, macOS, and Linux, and the reporting source is vendor:ubuntu, meaning the CVE is also consumed by a downstream Linux distributor that rebuilds Chromium from upstream sources. Chrome stable-channel advisories routinely bundle multiple unrelated fixes, each with its own CVE, and Google frequently withholds component-level detail until a majority of users have updated, which is a plausible explanation for the empty description. The reporting party being a distributor rather than the upstream vendor also means the record may originate from upstream fixed-version metadata imported into the distribution tracker. Any claim about the specific vulnerable subsystem, the attack vector, or whether rendering attacker-controlled web content is sufficient to trigger the flaw is unverified in this dataset; the advisory referenced above is the authoritative source to consult once it is populated, alongside NVD and the Ubuntu CVE tracker.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB