What is the CVSS score of CVE-2026-19151?

CVE-2026-19151 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Google Chrome are affected by CVE-2026-19151?

Google Chrome versions before 151.0.7922.109 contain a vulnerability allowing unauthorized code execution through malicious webpages; no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-19151?

Within 24 hours, inventory all Chrome installations across the organization and identify systems accessing sensitive data; communicate the vulnerability severity to all stakeholders and prioritize patch deployment. Within 7 days, deploy Chrome version 151.0.7922.109 or later to all affected systems using your standard software distribution process; consider forced updates on high-risk endpoints to prevent user deferral. Within 30 days, verify 100% deployment coverage through your asset management system and conduct spot-check audits across representative endpoints to ensure no outdated versions remain in use.

Google Chrome CVE-2026-19151

EUVD-2026-54122 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-wmf9-8jqm-79p6

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network delivery via HTML page requires no attacker privileges; user must visit the page (UI:R); sandbox containment keeps scope unchanged (S:U) with full C/I/A impact within that scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:31 vuln.today

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within the Chrome sandbox is possible in Google Chrome versions prior to 151.0.7922.109 due to a use-after-free vulnerability in the V8 JavaScript engine, triggerable by a remote attacker through a specially crafted HTML page. The attacker achieves arbitrary code execution confined to the Chrome renderer sandbox, requiring no privileges but necessitating user interaction to visit a malicious page. Google has released a fix in version 151.0.7922.109; SSVC assessment confirms no known active exploitation at time of analysis, and no public exploit code has been identified.

Technical ContextAI

V8 is Google's open-source, high-performance JavaScript and WebAssembly engine used in Chrome and other Chromium-based browsers. CWE-416 (Use After Free) occurs when a program continues to use a pointer after the referenced memory has been freed, allowing an attacker to place controlled data in the freed memory region and redirect execution. In browser contexts, V8 use-after-free vulnerabilities are particularly critical because JavaScript can be used to precisely manipulate heap layout and trigger the freed memory reference through crafted object lifecycles. Affected versions are captured in EUVD as Chrome builds below 151.0.7922.109. The sandbox scope designation (S:U in the CVSS vector) indicates code execution is constrained within the Chrome renderer process sandbox, meaning a sandbox escape (a separate exploit) would be required to fully compromise the underlying OS.

RemediationAI

The primary fix is to update Google Chrome to version 151.0.7922.109 or later via the browser's built-in updater or from the official Google Chrome download page. The stable channel update was announced at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. For organizations that cannot immediately patch, compensating controls include enforcing network-level restrictions to block access to untrusted external websites (e.g., DNS filtering or web proxy allowlisting), deploying browser isolation solutions that render web content in remote sandboxed environments, and applying enterprise policies (via Chrome Browser Cloud Management or GPO) to disable JavaScript execution on untrusted origins - though this last option will break significant web functionality and should be scoped carefully to highest-risk users. Chromium-based browsers (Edge, Brave, Opera) that embed V8 may also require separate vendor-specific updates.