Google Chrome CVE-2026-19169

The victim must be running Google Chrome prior to version 151.0.7922.109 on a supported desktop platform and must actively visit an attacker-controlled or attacker-modified HTML page (UI:R). The Contextual Tasks feature must be present and active, which represents a default state for the affected version range - no non-default configuration is required on the victim's side. No authentication or prior foothold is required from the attacker (PR:N). What limits exploitation: the single-user-interaction requirement means the attacker must induce the victim to navigate to the crafted page (e.g., via phishing, malvertising, or a compromised third-party site); fully automated drive-by exploitation without user action is not possible under this vector. The privilege escalation appears to remain scoped within the browser process (S:U), meaning a separate sandbox escape would be needed to achieve OS-level access.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals high real-world risk for environments that have not patched: the attack is network-delivered, requires no authentication, and demands only a single user interaction (visiting a page). The UI:R requirement is a meaningful friction point that prevents fully automated, zero-click mass exploitation - reducing risk compared to PR:N/UI:N scenarios. No EPSS data was provided in the intelligence package; no CISA KEV listing or confirmed active exploitation has been identified, and no POC is documented. Notably, the reported impact is 'privilege escalation' while the CVSS scope is S:U - this combination typically implies intra-process or intra-browser privilege elevation rather than a full OS-level sandbox escape; defenders should verify with the Chromium issue tracker (issues.chromium.org/issues/537390933) as the bug is likely still access-restricted. Chromium security severity is rated High, consistent with the CVSS band. The net assessment: elevated priority for enterprise patch management, but not an immediate incident-response trigger absent KEV confirmation.

An attacker hosts a malicious web page containing crafted HTML that exploits the insufficient input validation in Chrome's Contextual Tasks feature. A victim using an unpatched Chrome build (prior to 151.0.7922.109) visits the page - via a phishing link, malicious ad, or compromised website - triggering the vulnerability and allowing the attacker to escalate privileges within the browser context. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests an experienced researcher could develop a reliable exploit from the vulnerability class alone.