What is the CVSS score of CVE-2026-19169?

CVE-2026-19169 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19169?

A high-severity privilege escalation flaw in Google Chrome (CVE-2026-19169, CVSS 8.8) can be exploited through malicious web pages to escalate attacker privileges on compromised employee systems.. A patch is available.

How to fix or mitigate CVE-2026-19169?

Within 24 hours: Inventory Chrome deployment across your organization and enable automatic Chrome updates on all systems. Within 7 days: Verify that all Chrome instances have auto-updated to version 151.0.7922.109 or later using your endpoint management tools; run forced update cycles for any non-compliant systems. Within 30 days: Complete a full compliance audit to confirm 100% of Chrome deployments are at or above version 151.0.7922.109, and document any exceptions or legacy systems that cannot be updated.

Google Chrome CVE-2026-19169

EUVD-2026-54269 HIGH

Improper Input Validation (CWE-20)

2026-08-06 chrome-cve-admin@google.com

GHSA-xpp8-5h37-jfv5

Privilege Escalation Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network delivery via crafted HTML, no attacker privileges needed, single user interaction required; scope unchanged as privilege escalation appears browser-contained per S:U vendor assignment.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:23 vuln.today

CVSS changed

Aug 07, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Privilege escalation in Google Chrome's Contextual Tasks feature (prior to 151.0.7922.109) allows a remote attacker to escalate privileges by luring a victim to a crafted HTML page that delivers insufficiently validated untrusted input. The vulnerability carries a CVSS 8.8 score, reflecting high confidentiality, integrity, and availability impact with no prior authentication required from the attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and Chrome's ubiquitous deployment surface make prompt patching a priority.

Technical ContextAI

The vulnerability resides in Chrome's 'Contextual Tasks' subsystem, a feature in the Chromium browser engine responsible for processing contextual user interactions. The root cause is classified as CWE-20 (Improper Input Validation): the component fails to adequately validate or sanitize untrusted input originating from a renderer-supplied HTML page before acting on it, enabling attacker-controlled data to influence privileged execution paths. The attack surface is the HTML rendering pipeline - standard for Chromium-based vulnerabilities - where crafted page content can trigger logic in features that were not designed to handle adversarial input. CPE-level specificity narrows the affected scope to Chrome versions below 151.0.7922.109 across all platforms supported by that build line.

RemediationAI

Update Google Chrome to version 151.0.7922.109 or later immediately; this is the vendor-released patch confirmed via the Chrome stable channel advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome auto-updates by default on most managed and consumer systems, but administrators should verify deployment via fleet management tools (e.g., Google Admin, SCCM, or Munki). As a compensating control prior to patching, organizations can restrict access to untrusted or external web content via proxy/DNS filtering - note this does not protect against attacker-controlled content embedded in otherwise-trusted sites. Disabling JavaScript globally would prevent the crafted-HTML attack surface but carries severe usability trade-offs. Chromium-based browsers built on this codebase (Edge, Brave, etc.) should also be assessed for exposure against their respective upstream patch timelines.