What is the CVSS score of CVE-2026-19150?

CVE-2026-19150 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Google Chrome are affected by CVE-2026-19150?

A remote code execution vulnerability in Google Chrome's V8 JavaScript engine (CVE-2026-19150) allows unauthenticated attackers to execute arbitrary code within the browser sandbox by hosting a…. A patch is available.

How to fix or mitigate CVE-2026-19150?

Within 24 hours, inventory all Chrome installations across your infrastructure and identify systems still running versions prior to 151.0.7922.109. Within 7 days, deploy Chrome 151.0.7922.109 or later to all endpoints through your software distribution mechanism; configure automatic updates if not already enabled. Within 30 days, verify patch deployment completion and establish monitoring for exploitation attempts targeting this CVE.

Google Chrome CVE-2026-19150

EUVD-2026-54121 HIGH

Protection Mechanism Failure (CWE-693)

2026-08-06 chrome-cve-admin@google.com

GHSA-rf7w-2xrf-qfwr

RCE Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted web page (AV:N, AC:L, PR:N), requires victim to load the page (UI:R); sandbox containment limits scope (S:U) with full CIA impact within the renderer.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:32 vuln.today

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within Chrome's sandboxed renderer process is achievable in Google Chrome prior to 151.0.7922.109 through a crafted HTML page exploiting an inappropriate implementation in the V8 JavaScript engine. An unauthenticated remote attacker needs only to lure a victim to a malicious page - no credentials or special privileges are required on the attacker's side. Google has rated this High severity (Chromium classification); no public exploit has been identified at time of analysis, and CISA SSVC reports exploitation status as none, though technical impact is rated total within the sandbox boundary.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine embedded in Chrome, responsible for parsing, compiling, and executing JavaScript at runtime. CWE-693 (Protection Mechanism Failure) identifies the root cause class: the engine fails to correctly enforce an internal protection mechanism, allowing attacker-controlled JavaScript to bypass intended safeguards and achieve arbitrary code execution in the renderer process. Because Chrome's scope is 'Unchanged' (S:U in the CVSS vector), exploitation is confined to the sandboxed renderer - full host-OS compromise would additionally require a separate sandbox escape vulnerability. The Chromium issue tracker reference (issues.chromium.org/issues/526380803) and the Chrome Releases advisory confirm this is a V8-specific flaw. No CPE string was supplied, but the EUVD affected-version record unambiguously identifies the boundary as Chrome versions below 151.0.7922.109.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.109 or later, as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's auto-update mechanism should deploy this automatically in most consumer environments; enterprise administrators should verify rollout via Chrome Browser Cloud Management or equivalent fleet tooling and confirm the installed version reports 151.0.7922.109 or higher. If immediate patching is operationally blocked, consider enforcing web content filtering or DNS-layer blocking of untrusted and newly registered domains to reduce drive-by exposure - however, these controls do not address the vulnerability and carry the trade-off of blocking legitimate browsing. Disabling JavaScript globally would eliminate the V8 attack surface but renders the majority of web applications non-functional and is not a practical production mitigation for most environments.