What is the CVSS score of CVE-2026-19175?

CVE-2026-19175 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-19175?

A critical vulnerability in Google Chrome desktop (versions before 151.0.7922.109) enables remote code execution through a browser sandbox escape, allowing attackers to compromise any user who visits…. A patch is available.

How to fix or mitigate CVE-2026-19175?

Within 24 hours: Inventory all systems running Chrome desktop and communicate the critical update to end users with direct guidance to enable auto-update or visit chrome://help; prioritize outreach to users with access to sensitive data, financial systems, or administrative accounts. Within 7 days: Deploy Google Chrome version 151.0.7922.109 or later organization-wide through auto-update mechanisms, managed deployment (SCCM, Jamf, MDM), or managed browser policies; verify completion via endpoint management tools and monitor update adoption to reach at least 90% compliance. Within 30 days: Conduct full Chrome version inventory to confirm 100% compliance, ensure auto-update is mandated by policy, implement browser telemetry to detect exploitation attempts targeting this CVE, and review browser security controls to prevent similar bypass attacks.

Google Chrome CVE-2026-19175

EUVD-2026-54140 CRITICAL

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-25g9-fmc9-9m6p

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote via crafted page with user interaction and scope change to the browser process; AC:H because reliably weaponizing a UAF into a sandbox escape needs heap grooming and likely chaining.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:25 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.109 stems from a use-after-free in the Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to a scope change, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and no CISA KEV listing, but Chrome renderer/sandbox-escape bugs are historically high-value targets.

Technical ContextAI

The flaw is a CWE-416 use-after-free within Chrome's Payments subsystem, the browser-side machinery implementing the Payment Request/Payment Handler web APIs. A use-after-free occurs when memory is freed but a dangling pointer continues to be referenced, allowing an attacker who controls heap allocation timing to reclaim that memory with attacker-controlled data and corrupt program state. Because the Payments logic bridges the sandboxed renderer and higher-privileged browser process, a memory-corruption primitive here can be leveraged toward a sandbox escape rather than mere in-renderer code execution. The affected code path is Chromium-based, so the same defect class conceptually extends to other Chromium downstreams (Edge, Brave, Opera) that had not yet merged the fix, though only Google Chrome is named here.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.109 - update to this version or later via Chrome's built-in updater (chrome://settings/help) and fully relaunch the browser so the new binary and renderer are loaded, as per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. In managed fleets, push the update through your enterprise deployment channel (Google Admin console / MSI / package manager) and confirm forced relaunch, since users leaving Chrome open indefinitely will not receive the fix. As an interim compensating control before patching you may reduce exposure by restricting use of the Payment Request API or steering users away from untrusted sites, but there is no supported per-feature kill switch for the Payments component and disabling it fully is not a standard configuration, so patching promptly is the only reliable remediation. Chromium-based browsers should be updated to the build incorporating the upstream fix once their vendors ship it.