What is the CVSS score of CVE-2026-19155?

CVE-2026-19155 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19155?

Google Chrome versions prior to 151.0.7922.109 contain a use-after-free vulnerability in the Payments component that enables sandbox escape, allowing attackers who have compromised a user's browser…. A patch is available.

How to fix or mitigate CVE-2026-19155?

Within 24 hours, issue an immediate deployment directive to upgrade all Google Chrome installations to version 151.0.7922.109 or later across your managed fleet, prioritizing administrative and high-risk user populations. By day 7, verify patch deployment completion using your endpoint management and EDR tools, confirming version compliance across all devices; document any unpatched systems and escalate to asset owners. Within 30 days, conduct forensic threat hunting across your environment for indicators of browser renderer compromise, review Chrome security events in your logs, and update your incident response playbook to treat confirmed renderer compromises as critical escalation events requiring immediate system isolation.

Google Chrome CVE-2026-19155

EUVD-2026-54125 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-qh77-m293-98r7

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape to host OS; PR:N as no victim-system authentication is required.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:30 vuln.today

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Payments component of Google Chrome prior to 151.0.7922.109 enables a sandbox escape when an attacker has already compromised the renderer process. Exploitation requires chaining a prior renderer compromise with delivery of a crafted HTML page, placing this firmly in the category of multi-stage browser exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and SSVC classifies exploitation status as none, though the technical impact is rated total due to the full sandbox escape capability.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory corruption where a program continues to reference heap memory after it has been freed, allowing an attacker to control that memory region and redirect execution. The vulnerable component is the Payments subsystem within Chrome's renderer, which handles web-based payment APIs (e.g., the Payment Request API). Chrome's multi-process architecture sandboxes the renderer process to limit the impact of memory corruption bugs; however, this vulnerability specifically enables escape from that sandbox, elevating attacker control from the sandboxed renderer to the broader host OS process. The CVSS vector AV:N/AC:H/S:C reflects both the network delivery and the inter-process scope change inherent in a sandbox escape. Affected CPE: Google Chrome versions prior to 151.0.7922.109 on desktop platforms.

RemediationAI

Update Google Chrome to version 151.0.7922.109 or later immediately; this is the vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. On managed endpoints, enforce Chrome update policies via Google Admin Console or enterprise MDM to push the patched version. As a temporary compensating control prior to patching, consider restricting access to payment-related web APIs via enterprise browser policies (e.g., disabling or allowlisting the Payment Request API), though this will break legitimate payment flows on affected sites. Monitoring browser process chains for unexpected child processes spawned outside the sandbox can serve as a detection signal for sandbox escape attempts.