What is the CVSS score of CVE-2026-19159?

CVE-2026-19159 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19159?

Google Chrome (all versions prior to 151.0.7922.109) contains a use-after-free vulnerability in the UI rendering engine that allows remote attackers to execute code on user devices through crafted…. A patch is available.

How to fix or mitigate CVE-2026-19159?

Within 24 hours: inventory Chrome deployment across your infrastructure (desktop, laptop, BYOD) and notify end-users that an update is available; distribute the specific version requirement (151.0.7922.109 or later). Within 7 days: pilot the Chrome update on a test group of 10-20 devices and confirm no business-critical web applications fail. Within 30 days: deploy the patched Chrome version (151.0.7922.109 or later) organization-wide via your managed software distribution tool (MDM, Intune, etc.), targeting all devices for auto-update and ensuring compliance reporting by device.

Google Chrome CVE-2026-19159

EUVD-2026-54128 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-8w2j-h45m-25mf

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via crafted HTML (AV:N); specific UI gestures imply timing or sequencing complexity (AC:H); no auth needed (PR:N); mandatory active interaction (UI:R); heap corruption yields full renderer impact (C:H/I:H/A:H) within sandbox scope (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:24 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Views UI rendering component of Google Chrome (all versions prior to 151.0.7922.109) enables a remote attacker to corrupt heap memory via a crafted HTML page, requiring the victim to perform specific UI gestures. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a fully network-delivered attack with no authentication barrier, though high attack complexity and mandatory user interaction substantially reduce opportunistic exploitation likelihood. No public exploit code or CISA KEV listing has been identified at time of analysis; Google rated this High severity internally and shipped a patch in the stable channel update.

Technical ContextAI

CWE-416 (Use After Free) in Chrome's Views framework - the cross-platform C++ UI toolkit responsible for rendering browser chrome elements such as toolbars, dialogs, and overlays. When a specially crafted HTML page drives specific UI gesture sequences, the Views component frees a heap object and subsequently dereferences the stale pointer, producing a type-confusion or arbitrary-write primitive in the renderer process. Use-after-free bugs in browser UI layers are particularly severe because they can corrupt internal object metadata exploitable for sandbox-escape primitives. The affected CPE range covers all Chrome desktop builds (Windows, macOS, Linux) below 151.0.7922.109, as confirmed by EUVD-2026-54128 and the Chromium issue tracker entry at issues.chromium.org/issues/536067175.

RemediationAI

Update Google Chrome to version 151.0.7922.109 or later immediately; this is the vendor-released patch confirmed via the stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's built-in auto-update mechanism will apply this in most managed and consumer environments; administrators should verify endpoint management policies force the update rather than defer it. If immediate patching is not feasible, compensating controls include restricting access to untrusted external websites via proxy policy, enforcing Site Isolation (already default in modern Chrome but verifiable via chrome://flags), and disabling JavaScript on untrusted origins - though the latter carries significant usability trade-offs. Note that these controls reduce the attack surface but cannot fully eliminate risk from a UI-gesture-based heap corruption if a user visits a controlled malicious page.