What is the CVSS score of CVE-2026-19556?

CVE-2026-19556 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-19556?

CVE-2026-19556 affects Google Chrome versions prior to 151.0.7922.137, enabling remote code execution when users visit malicious websites and posing risk to all affected organizational users.. A patch is available.

How to fix or mitigate CVE-2026-19556?

Within 24 hours, inventory all Chrome deployments and identify versions currently in use across the organization. Within 7 days, initiate staged rollout of Chrome version 151.0.7922.137 or later, prioritizing endpoints handling sensitive data and customer-facing systems. Complete full deployment across all systems within 30 days, ensuring no systems remain on vulnerable versions prior to 151.0.7922.137.

Google Chrome CVE-2026-19556

EUVD-2026-56983 HIGH

Use After Free (CWE-416)

2026-08-11 Chrome

GHSA-mx8c-h4fh-hwq7

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted webpage, no privileges required, mandatory user navigation (UI:R), impact confined to browser sandbox with no scope change to OS.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 14:23 vuln.today

CVSS changed

Aug 12, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Aug 11, 2026 - 21:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 11, 2026 - 21:23 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.

Technical ContextAI

V8 is Google Chrome's open-source JavaScript and WebAssembly engine, responsible for parsing and executing JavaScript on virtually every webpage. CWE-416 (Use After Free) describes a class of memory corruption bugs where a program continues to reference a memory region after it has been deallocated; in V8 this can occur during garbage collection or object lifecycle management within the JIT compiler or heap. Successful exploitation of a UAF in V8 typically allows an attacker to corrupt heap memory in a controlled fashion, enabling arbitrary read/write primitives and ultimately shellcode execution - though in this case, execution is confined to Chrome's sandbox process boundary. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 151.0.7922.137 across Windows, macOS, and Linux.

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.137 or later, released via the stable channel and documented at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html. Chrome's auto-update mechanism should apply this automatically; administrators managing enterprise fleets should force-push the update via policy (e.g., Google Admin Console or Group Policy) and verify via chrome://version. If immediate patching is not feasible, a compensating control is to restrict end-user access to untrusted external websites via web proxy or DNS filtering - this reduces the social-engineering surface but does not eliminate risk from internal or compromised trusted sites, and carries significant usability trade-offs. Disabling JavaScript globally is an extreme measure that would block exploitation but render most web applications non-functional. No other vendor-documented workarounds were identified in the available references.