What is the CVSS score of CVE-2026-19142?

CVE-2026-19142 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19142?

Google Chrome versions prior to 151.0.7922.109 contain a vulnerability that could allow remote attackers to execute arbitrary code when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-19142?

Within 24 hours, inventory Chrome versions across all managed devices using endpoint management tools or browser reporting utilities to identify systems running versions prior to 151.0.7922.109. Within 7 days, deploy Chrome version 151.0.7922.109 or later through your software distribution system, GPO, or auto-update mechanisms, prioritizing high-value users such as executives and developers with sensitive access. Within 30 days, verify full deployment compliance through automated reporting, ensuring no devices remain on vulnerable versions and documenting completion for compliance records.

Google Chrome CVE-2026-19142

EUVD-2026-54114 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-w3c4-94r5-cpv4

Denial Of Service Google Use After Free Memory Corruption Red Hat

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via crafted HTML (AV:N), specific UI gesture sequence required increases complexity (AC:H, UI:R), unauthenticated; full C/I/A impact reflects UAF-to-code-execution potential; scope unchanged due to Chrome sandbox containment.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:23 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption via use-after-free in Google Chrome's Views UI framework (prior to 151.0.7922.109) can be triggered by a remote attacker who delivers a crafted HTML page and induces a user to perform specific UI gestures. Successful exploitation may lead to arbitrary code execution or denial of service within the browser process. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS AC:H rating signals non-trivial exploitation conditions that reduce real-world risk compared to the high severity label.

Technical ContextAI

CWE-416 (Use After Free) arises when heap-allocated memory is freed but a dangling pointer to that memory is subsequently dereferenced. The vulnerability resides in Chrome's Views component, which is the cross-platform C++ UI widget toolkit used to render Chrome's interface elements such as dialogs, menus, and controls. A specially crafted HTML page can drive specific UI interactions that trigger a Views object to be freed while a reference to it remains live, corrupting heap memory. The Chromium security severity is rated High, consistent with the potential for memory-safety exploitation. Affected versions span all Chrome desktop releases prior to 151.0.7922.109 across Windows, macOS, and Linux as indicated by the EUVD affected version range.

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.109 or later via Chrome's built-in update mechanism (Settings > About Chrome) or enterprise deployment tooling such as Google Admin Console or third-party patch management platforms. The patch details are confirmed in the Google Chrome Releases advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. If immediate update is not possible, a compensating control is to restrict access to untrusted web content by enforcing enterprise browsing policies that block navigation to unknown or unapproved external sites - this reduces exposure since the attack requires a user to visit a crafted page. Disabling JavaScript is a theoretical workaround but carries severe usability trade-offs and may not fully prevent the triggering condition. Organizations running Chrome in kiosk or locked-down modes should verify that automatic updates are enabled and confirmed to have applied.