EUVD-2026-89258
GHSA-5w4q-vmpx-j2jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted web content
-
ExecutionTrigger browser engine flaw
-
ImpactImpact within Chrome process (unconfirmed)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation prerequisites cannot be extracted because the description is empty. For Google Chrome desktop stable-channel fixes, exploitation typically requires the victim to browse to or render attacker-controlled web content (user interaction), and is limited to systems running an unpatched Chrome desktop version prior to the September 2026 stable update; the patch is available and applying it removes exposure. The exact feature, protocol, or configuration required is not documented for this specific CVE and must be confirmed against the vendor advisory. |
| Impact | Risk cannot be quantified from the provided signals because nearly every scoring input is absent: there is no CVSS score or vector, no CWE, no EPSS probability, no KEV listing, and no public POC. The only affirmative signals are that the issue was published in the Google Chrome Stable Channel Update for Desktop (September 2026) with a patch available, and was surfaced via vendor:ubuntu tracking. Because Chrome is a browser-class attack surface, the historical baseline for such stable-channel fixes is network-reachable, remote code execution or memory-corruption bugs triggered by malicious web content - but that is an inference from product class, NOT confirmed for this specific ID. STATED EXPLICITLY: the description is unknown, so attack vector, complexity, privilege, and impact are all unverified; the vulnerability class cannot be determined. There is no evidence of active exploitation (not in KEV) and no POC, so despite Chrome's ubiquity this should be treated as a routine 'patch on next update cycle' item rather than an emergency, unless the vendor advisory later assigns a high severity. Verify the specific bug class and CVSS via the Chrome Releases blog and NVD once populated. |
| Exploit ScenarioDerived | Based on Chrome's typical stable-channel fixes, a plausible scenario is a user navigating to attacker-controlled web content that triggers a flaw in the browser's rendering or JavaScript engine, potentially leading to memory corruption within the browser process. However, the actual vulnerability class is undocumented for this CVE, so this scenario is inferred from product context and not confirmed. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Google Chrome desktop builds that have not yet received the September 2026 stable-channel update are affected by CVE-2026-95359, a flaw for which the vendor has published a fix in the Chrome Releases stable channel advisory (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html). The advisory is the only substantive intelligence available: the CVE description is empty, and no CVSS score, CVSS vector, CWE, EPSS probability, or CPE data was supplied, so the exact component, attack vector, and privilege requirements cannot be confirmed from the available data. There is no KEV listing and no public exploit code identified at time of analysis, so exploitation is not confirmed to be occurring; however, because Chrome renders attacker-controlled web content by default, unpatched desktop installations should be treated as exposed until the stable-channel update is applied.
RemediationAI
Patch status per the supplied data is that a fix is available from the vendor: apply the September 2026 Chrome desktop stable-channel update identified in Google's advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html - the input does not include an exact version string, so the specific patched build number must be taken from that advisory rather than assumed. Windows and macOS users can force the update via Chrome's Help > About flow and then fully restart the browser, since a restart is required for the new binary to take effect; Ubuntu and other Linux users should install the updated Chromium/Chrome package from their distribution repositories once the Ubuntu security update lands. No workaround is documented for this specific CVE, and because the vulnerable component is not disclosed in the available data, feature-level mitigations such as disabling particular web-platform features or flags cannot be mapped to this flaw with confidence - the practical trade-off is that the only reliable mitigation is patching, with browser isolation, aggressive filtering of untrusted web content, or restricting browsing on high-value endpoints serving as partial, higher-friction compensating controls that reduce but do not eliminate exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-95359 is tracked against Google Chrome and is fixed through Google's normal stable-channel release process, as evidenced by the sole reference pointing to the Chrome Releases blog. In the Chrome security model, fixes shipped in a stable-channel update can touch the Blink renderer, the V8 JavaScript engine, the GPU/network/sandboxed utility processes, or the browser's IPC and site-isolation layers, but nothing in the supplied data identifies which subsystem is involved: no CWE is provided, so the root-cause class (memory-safety, use-after-free, type confusion, policy bypass, integer overflow, etc.) cannot be determined, and no CPE strings are available to pin the affected code base. The reporting attribution to vendor:ubuntu indicates the fix is being propagated through Ubuntu's packaging of Chromium/Chrome in addition to Google's own distribution channels, which means Linux users may receive the update on a slightly different cadence than the upstream stable channel. Because the description field is empty, this analysis deliberately avoids attributing a specific vulnerability class, memory-corruption primitive, or sandbox escape to the CVE; the authoritative source for component-level detail remains the linked vendor advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Primary rating from Vendor (vendor:ubuntu) · only source for this CVE.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB