What is the CVSS score of CVE-2026-19164?

CVE-2026-19164 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-19164?

A critical sandbox escape in Google Chrome's Codecs component (CVE-2026-19164, CVSS 9.6) enables remote code execution when users view malicious web pages, affecting all desktop Chrome users across…. A patch is available.

How to fix or mitigate CVE-2026-19164?

Within 24 hours: notify all users to update Google Chrome to version 151.0.7922.109 or later and deploy mandatory update policies through your endpoint management platform. Within 7 days: verify that at least 95% of Chrome installations have upgraded by cross-referencing asset inventory and browser telemetry; consider blocking older Chrome versions at the network level if your environment supports it. Within 30 days: achieve 100% compliance by enforcing automatic updates, audit any remaining pre-151.0.7922.109 installations for evidence of compromise using EDR or network logs, and document completion in your vulnerability management system.

Google Chrome CVE-2026-19164

EUVD-2026-54133 CRITICAL

Improper Input Validation (CWE-20)

2026-08-06 chrome-cve-admin@google.com

GHSA-mh4h-c4w6-m987

Information Disclosure Google Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs user interaction (UI:R) but no privileges (PR:N); sandbox escape crosses the renderer/host boundary (S:C) with high C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:25 vuln.today

CVSS changed

Aug 07, 2026 - 13:22 NVD

9.6 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Codecs component (versions prior to 151.0.7922.109) allows a remote attacker to break out of the renderer sandbox when a victim views a crafted HTML page, via insufficient validation of untrusted input (CWE-20). Rated CVSS 9.6 with a changed scope, the flaw affects the desktop Stable channel across all platforms and is fixed in 151.0.7922.109. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Chromium's media Codecs subsystem, the code responsible for demuxing and decoding audio/video content embedded in web pages. Codec parsers routinely process complex, attacker-controlled binary structures, making them a recurring source of memory-safety and input-validation defects. The root cause is classified as CWE-20 (Improper Input Validation): the codec path accepts malformed or unexpected input without adequate checks, which can be leveraged to influence execution beyond the intended renderer sandbox boundary. The affected component is the Chrome desktop browser (Google Chrome prior to 151.0.7922.109); no specific CPE string was supplied in the input, but the EUVD entry scopes it to the Chrome 151.0.7922.x branch below 151.0.7922.109.

RemediationAI

Vendor-released patch: 151.0.7922.109 - update Google Chrome to 151.0.7922.109 or later on all desktop platforms via the browser's built-in updater (Settings > About Chrome) and restart the browser to apply, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html). In managed fleets, push the update through your enterprise Chrome update policy and confirm end users have relaunched, since Chrome updates only take effect after a restart. No supported workaround fully removes the risk; as an interim compensating control you can reduce exposure to malicious media by restricting browsing to trusted sites, deploying URL/DNS filtering, or disabling autoplay of untrusted media where feasible - but these do not eliminate the codec parsing path and are inferior to patching. Users of Chromium-based browsers should apply their vendor's update once the Chromium fix is incorporated.