What is the CVSS score of CVE-2026-19141?

CVE-2026-19141 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19141?

Chrome for Android versions before 151.0.7922.109 contain a critical sandbox escape vulnerability (CVSS 8.3) that allows attackers to escalate from browser compromise to full Android OS access.. A patch is available.

How to fix or mitigate CVE-2026-19141?

Within 24 hours: Inventory all Chrome installations on Android devices across the organization and identify users with Chrome versions prior to 151.0.7922.109; prepare internal communication notifying users of the security update requirement. Within 7 days: Deploy Chrome for Android 151.0.7922.109 or later to all affected devices through mobile device management (MDM) systems or direct user notification; prioritize corporate-owned devices and those with sensitive data access. Within 30 days: Audit deployment logs to verify patch application across all affected devices; conduct threat hunting for signs of renderer process compromise or suspicious OS-level access on vulnerable devices during the exposure window.

Google Chrome CVE-2026-19141

EUVD-2026-54113 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-j3c7-7qwm-398m

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N and PR:N because no Chrome authentication is required; AC:H reflects chained exploit complexity; S:C confirmed by sandbox escape; UI:R for crafted-page delivery.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:23 vuln.today

CVSS changed

Aug 07, 2026 - 13:22 NVD

8.3 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Chrome's Resources component on Android enables sandbox escape for attackers who have already established a foothold in the renderer process. Affected versions are all Chrome for Android releases prior to 151.0.7922.109. The CVSS scope change (S:C) and High ratings across Confidentiality, Integrity, and Availability confirm that successful exploitation breaks out of the browser sandbox, exposing the underlying Android OS. No public exploit code or CISA KEV listing exists at time of analysis, though the chained exploit capability (renderer-to-sandbox-escape) represents a critical capability for advanced threat actors.

Technical ContextAI

CWE-416 (Use After Free) arises when a program continues to reference memory after it has been freed, allowing an attacker to influence or control the dangling pointer's contents and redirect execution. In this case, the vulnerable component is the Resources subsystem of Chromium's renderer on Android. Chrome's multi-process architecture sandboxes renderer processes to limit blast radius from memory corruption bugs; however, a UAF in a privileged or shared resource boundary can be leveraged to corrupt adjacent memory in a more privileged process context, achieving a sandbox escape. The CVSS vector AV:N/AC:H/UI:R/S:C reflects the network-delivered attack, the complexity of coordinating the UAF with a prior renderer compromise, required user interaction (visiting a crafted page), and the confirmed scope change across process isolation boundaries. The affected CPE scope is Google Chrome on Android, versions prior to 151.0.7922.109.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.109 or later via the Google Play Store or Chrome's built-in update mechanism. The vendor patch is confirmed available per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. For environments where immediate updating is not possible, compensating controls include restricting access to untrusted web content via enterprise browser policy (block non-allowlisted URLs), enabling Chrome's Site Isolation feature if not already active (reduces renderer scope), and deploying Android Enterprise policies to prevent sideloaded or untrusted browser configurations. Note that these controls reduce attack surface but cannot fully mitigate a UAF exploit in a compromised renderer. Chromium-derived browsers on Android should be assessed separately for patch availability from their respective vendors.