What is the CVSS score of CVE-2026-19165?

CVE-2026-19165 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19165?

Google Chrome versions prior to 151.0.7922.109 contain a use-after-free vulnerability (CVE-2026-19165) enabling arbitrary code execution within the browser sandbox if users install a malicious…. A patch is available.

How to fix or mitigate CVE-2026-19165?

Within 24 hours, inventory Chrome deployments to identify instances running versions prior to 151.0.7922.109 and assess organizational exposure based on extension policies. Within 7 days, deploy Chrome update 151.0.7922.109 (stable channel release, 01 August 2026) across all endpoints, prioritizing users and administrators with extension installation privileges. Within 30 days, verify patch deployment completion across the estate and review extension policies to restrict third-party extension installation to designated administrators only, limiting future attack surface.

Google Chrome CVE-2026-19165

EUVD-2026-54134 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-2865-9gvm-5wwx

RCE Denial Of Service Google Use After Free Memory Corruption Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:N for network-delivered extension; AC:H for UAF trigger complexity plus social engineering; UI:R mandatory; S:U and C/I/A:H reflect full sandboxed-process compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:23 vuln.today

CVSS changed

Aug 07, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Chrome Extensions subsystem allows sandboxed arbitrary code execution in Google Chrome prior to 151.0.7922.109, requiring a victim to install a crafted malicious extension. The UAF (CWE-416) memory corruption condition is exploitable remotely but demands high attack complexity and active user interaction, resulting in code execution confined within Chrome's sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a fix in the stable channel update of 01 August 2026.

Technical ContextAI

The vulnerability resides in Chrome's Extensions component, the C++ subsystem responsible for loading, managing, and executing browser extensions. CWE-416 (Use After Free) occurs when heap-allocated memory is freed but a dangling pointer to that region is subsequently dereferenced, allowing an attacker to influence the freed memory's contents and redirect execution. The affected codebase is tracked in the Chromium issue tracker at issues.chromium.org/issues/536512612. Affected CPE is Chrome versions prior to 151.0.7922.109 on desktop platforms (Windows, macOS, Linux). Exploitation leverages a crafted Chrome Extension - a ZIP-packaged set of JavaScript, HTML, and native messaging components - to trigger the memory-safety flaw inside the renderer or extension service process, not the main browser process, which is why execution remains sandboxed (CVSS S:U).

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.109 or later using Chrome's built-in auto-update mechanism (chrome://settings/help) or via enterprise deployment tooling. The vendor advisory is available at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. For environments where immediate patching is not possible, an effective compensating control is to enforce a managed extension allow-list via Chrome Enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist), which prevents users from installing unapproved extensions and eliminates the primary exploitation prerequisite. Disabling the Chrome Web Store access entirely via policy (ExtensionInstallSources) is a more aggressive control with the trade-off of blocking all extension use. Organizations using Chromium-based browsers (Edge, Brave, etc.) should monitor their respective vendor advisories for patched releases based on the same upstream fix.