What is the CVSS score of CVE-2026-19145?

CVE-2026-19145 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-19145?

Google Chrome versions prior to 151.0.7922.109 contain a use-after-free vulnerability in the Translate component enabling remote code execution when users visit attacker-controlled webpages.. A patch is available.

How to fix or mitigate CVE-2026-19145?

Within 24 hours: complete an inventory of Chrome deployments across managed and BYOD endpoints and verify patch distribution capabilities through your deployment channels. Within 7 days: deploy Chrome 151.0.7922.109 or later to all affected systems, prioritizing user-facing endpoints through standard patch management processes. Within 30 days: conduct endpoint scanning and compliance audits to confirm zero instances of vulnerable versions remain in production.

Google Chrome CVE-2026-19145

EUVD-2026-54117 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-8g9r-mp6v-7m38

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network delivery via crafted HTML (AV:N), no privileges required (PR:N), victim must visit the page (UI:R), and impact is confined to the renderer sandbox with no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:23 vuln.today

CVSS changed

Aug 07, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's Translate component (versions prior to 151.0.7922.109) enables remote attackers to execute arbitrary code within the browser's renderer sandbox by directing a user to a crafted HTML page. The CVSS 8.8 score reflects network-accessible, low-complexity exploitation gated only by a single user interaction - visiting an attacker-controlled page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE primitive within one of the world's most widely deployed browsers represents a materially significant attack surface.

Technical ContextAI

CWE-416 (Use After Free) describes a memory corruption class in which a program continues to use a pointer after the referenced heap memory has been freed, allowing an attacker who can control heap layout to redirect execution. The affected component is Chrome's built-in Translate subsystem, which processes HTML page content for language detection and translation. A crafted HTML page can trigger the UAF condition during Translate processing in the renderer process. Critically, Chrome's multi-process architecture means the renderer runs inside a sandbox, so successful exploitation achieves code execution within that constrained environment rather than directly on the underlying OS. Per EUVD data, affected versions are all Chrome releases prior to 151.0.7922.109.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.109 or later, as released in the stable channel update detailed at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome auto-updates by default, but enterprise administrators should confirm propagation via fleet management tooling and force-push the update if needed. As a compensating control before patching, disabling the Translate feature via enterprise policy (set TranslateEnabled to false in Chrome's managed policy configuration) eliminates the vulnerable code path at the cost of removing in-browser translation for all users. Restricting web access to untrusted origins via proxy or DNS filtering reduces exposure surface but does not remediate the vulnerability and should not substitute for patching.