What is the CVSS score of CVE-2026-19172?

CVE-2026-19172 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19172?

Chrome versions before 151.0.7922.109 contain a sandbox escape vulnerability that allows attackers with renderer process access to execute code at the OS level, undermining the browser's primary…. A patch is available.

How to fix or mitigate CVE-2026-19172?

Within 24 hours: Validate Chrome 151.0.7922.109 deployment procedures and initiate update notifications to all users, ensuring automatic updates are enabled. Within 7 days: Deploy Chrome 151.0.7922.109 or later across all managed systems via enterprise auto-update mechanisms, prioritizing high-value workstations and shared systems. Within 30 days: Verify successful deployment through endpoint management logs, audit update coverage, and establish monitoring for exploitation attempts targeting renderer process escape techniques.

Google Chrome CVE-2026-19172

EUVD-2026-54268 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-xgp9-vp73-wgrv

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N for web-delivered crafted HTML; AC:H for prerequisite renderer compromise; S:C and full C/I/A confirmed by sandbox escape to host OS.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 02:25 vuln.today

CVSS changed

Aug 07, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Use-after-free in Chrome's Views component prior to version 151.0.7922.109 enables a sandbox escape for remote attackers who have already compromised the renderer process, via a crafted HTML page. The CVSS scope change (S:C) confirms the potential for OS-level code execution beyond Chrome's renderer sandbox, earning a Critical severity designation from the Chromium security team despite an NVD score of 8.3. No public exploit code or CISA KEV confirmation has been identified at time of analysis, though this vulnerability class is a high-value target frequently weaponized as the second stage of browser exploit chains by sophisticated threat actors.

Technical ContextAI

Chrome's Views framework is the C++ UI layer that manages window, widget, and rendering-surface hierarchies on desktop platforms, bridging the sandboxed renderer process and the privileged browser process. A use-after-free (CWE-416) arises when heap memory is freed but a dangling pointer to that region is subsequently dereferenced, creating a controlled memory-corruption primitive. In Chrome's multi-process architecture, the renderer runs in a low-privilege sandbox; a UAF in Views - operating at the browser-process boundary - provides an avenue to corrupt browser-process memory and break containment. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H encodes this precisely: network-deliverable via crafted HTML, high complexity reflecting the prerequisite renderer compromise, user interaction for page visit, and a confirmed scope change to the host system. No CPE strings were supplied in the input data; the affected product is identified via EUVD as desktop Chrome versions below 151.0.7922.109.

RemediationAI

Update Google Chrome to version 151.0.7922.109 or later immediately using Chrome's built-in update mechanism (Menu > Help > About Google Chrome) or via your platform's package manager. The official Google advisory is at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Enterprise administrators should deploy the updated installer via Group Policy, Intune, or their endpoint management toolchain and verify version compliance across the fleet. Prior to patching, compensating controls are limited in effectiveness but include enabling Chrome's Enhanced Safe Browsing mode (reduces pre-exploitation delivery risk via malicious-site blocking, with the trade-off of sharing browsing data with Google), restricting navigation to untrusted external sites via DNS filtering or proxy allowlists, and ensuring renderer-level mitigations such as Site Isolation are active (enabled by default in modern Chrome builds). These controls reduce the attack surface but do not remediate the underlying UAF; patching remains the only definitive fix.