What is the CVSS score of CVE-2026-19170?

CVE-2026-19170 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19170?

Google Chrome for Android contains a critical sandbox escape vulnerability (CVE-2026-19170, CVSS 9.6) that allows remote attackers to break out of the browser sandbox when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-19170?

Within 24 hours, issue an urgent security notice to all mobile users and IT operations regarding the critical Chrome for Android vulnerability and initiate assessment of affected devices through MDM reporting. Within 7 days, begin staged rollout of Chrome for Android 151.0.7922.109 or later, prioritizing devices with sensitive users and corporate data access; configure MDM to enforce automatic updates on managed endpoints. Within 30 days, complete mandatory deployment across all managed Android devices and verify update compliance, with follow-up enforcement actions for non-compliant endpoints.

Google Chrome CVE-2026-19170

EUVD-2026-54267 CRITICAL

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-7f35-6h8x-96vv

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges (AV:N/PR:N) but a user click (UI:R); a WebGL UAF enabling sandbox escape crosses trust boundaries (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:24 vuln.today

CVSS changed

Aug 07, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from a use-after-free in the WebGL graphics component (CWE-416), letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates this Critical and CVSS scores it 9.6 with a scope change (S:C), reflecting the cross-boundary sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Chrome WebGL memory-corruption bugs are historically high-value exploitation targets.

Technical ContextAI

WebGL is Chrome's JavaScript API for hardware-accelerated 2D/3D rendering that bridges untrusted web content to the GPU process and underlying graphics drivers. A use-after-free (CWE-416) occurs when the code continues to reference a heap object after it has been freed, allowing an attacker who controls heap allocation timing via crafted WebGL calls to reclaim the freed memory with attacker-influenced data and corrupt program state. Because WebGL command handling can cross the renderer-to-GPU trust boundary, a controllable UAF here is a plausible primitive for the scope change (S:C) reflected in the CVSS vector, i.e., a sandbox escape rather than a renderer-only compromise. The affected code path is the Android build of Chrome (Chromium/Blink WebGL implementation) prior to 151.0.7922.109.

RemediationAI

Vendor-released patch: 151.0.7922.109 - update Google Chrome for Android to 151.0.7922.109 or later via Google Play (or the Chrome auto-update mechanism) and fully restart the browser so the new binary loads. Verify the deployed version in chrome://version and, in managed fleets, push the update through MDM/enterprise policy to force rollout. Per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html), no supported configuration-level workaround fully removes the WebGL code path on mobile; as an interim compensating control you can steer users away from untrusted sites and, where a managed policy surface exists, disable hardware-accelerated WebGL/3D APIs to shrink the attack surface, accepting that this breaks legitimate WebGL-based sites and degrades graphics performance. Because exploitation requires user interaction, user awareness (avoid untrusted links) meaningfully reduces exposure until patching completes. Details are tracked in Chromium issue https://issues.chromium.org/issues/537729021.