What is the CVSS score of CVE-2026-19156?

CVE-2026-19156 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-19156?

A remote code execution vulnerability in Google Chrome (CVE-2026-19156) could allow attackers to compromise employee workstations through malicious browser extensions, risking unauthorized access to…. A patch is available.

How to fix or mitigate CVE-2026-19156?

Within 24 hours, identify all Chrome installations in your environment and assess current versions; concurrently, publish a mandatory security alert to users warning against installing untrusted extensions and explaining the urgency of accepting Chrome updates. Within 7 days, deploy Chrome version 151.0.7922.109 or later organization-wide through your device management platform, prioritizing high-risk systems with access to sensitive data, financial systems, or intellectual property. Within 30 days, verify 100% patch adoption through automated inventory scanning, document completion in your vulnerability management system, and conduct a follow-up user awareness campaign on extension security practices.

Google Chrome CVE-2026-19156

EUVD-2026-54126 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-06 chrome-cve-admin@google.com

GHSA-2w9g-53qp-p3g5

Google Buffer Overflow Heap Overflow Suse Red Hat

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network delivery of malicious extension warrants AV:N; AC:H reflects heap-condition dependency; UI:R captures mandatory extension installation; full CIA:H reflects heap corruption RCE potential.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:24 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 7.5

DescriptionCVE.org

Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Google Chrome's Base component (versions prior to 151.0.7922.109) enables potential heap corruption and arbitrary code execution when a user installs a malicious Chrome Extension crafted by an attacker. Exploitation requires social engineering to achieve extension installation, reflected in the AC:H/UI:R CVSS metrics, which meaningfully constrains real-world attack scale compared to the raw 7.5 score. No public exploit identified at time of analysis, and a vendor-released patch is available in 151.0.7922.109.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a write beyond the allocated heap buffer boundary, which in Chrome's Base utility library - a foundational C++ support layer used pervasively across the Chromium codebase - can corrupt adjacent heap metadata or objects. Chrome Extensions execute in a privileged renderer context with access to extension APIs; a crafted extension can supply malformed data to Base component routines in a way that triggers the overflow. Heap corruption of this class can be leveraged for type confusion or control-flow hijacking within the Chrome process. Affected product per EUVD CPE data: Chrome versions in the range prior to 151.0.7922.109.

RemediationAI

Update Google Chrome to version 151.0.7922.109 or later immediately via the browser's built-in update mechanism (Chrome menu → Help → About Google Chrome) or through enterprise deployment tooling. The vendor advisory is available at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. For organizations that cannot patch immediately, enforce Chrome Extension installation policies via Google Admin Console or Group Policy to restrict extensions to a managed allowlist - this directly eliminates the prerequisite attack vector. The trade-off is operational friction if users rely on third-party extensions. Additionally, disabling the 'Allow users to install other extensions' policy setting blocks sideloaded and Web Store extensions outside the approved list, preventing the malicious extension delivery mechanism entirely. Chromium-based browser vendors should be monitored for their own patch releases if those browsers are in scope.