What is the CVSS score of CVE-2026-19558?

CVE-2026-19558 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-19558?

Google Chrome contains a code-execution vulnerability in its Extensions subsystem affecting all versions prior to 151.0.7922.137.. A patch is available.

How to fix or mitigate CVE-2026-19558?

Within 24 hours, audit Chrome deployment across your organization to identify systems running versions prior to 151.0.7922.137. Within 7 days, deploy Chrome 151.0.7922.137 or later to all endpoints through your standard patch management process, prioritizing administrative and high-risk user populations. Within 30 days, complete organization-wide deployment, verify all endpoints are current, and reinforce security policies restricting extension installation to approved sources only.

Google Chrome CVE-2026-19558

EUVD-2026-56985 HIGH

Use After Free (CWE-416)

2026-08-11 Chrome

GHSA-5qcx-j3rr-hjw9

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network delivery requires active user extension install (UI:R, AC:H); no privileges needed; sandbox containment (S:U) with full C/I/A impact within that scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 14:23 vuln.today

CVSS changed

Aug 12, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Aug 11, 2026 - 21:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 11, 2026 - 21:23 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's Extensions subsystem prior to version 151.0.7922.137 enables an attacker to execute arbitrary code inside the Chrome sandbox by convincing a target to install a crafted malicious extension. The vulnerability class (CWE-416) indicates improper memory management in the extension handling code, where a freed memory reference is later dereferenced, corrupting heap state in a way an attacker can direct toward code execution. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires deliberate social engineering to achieve extension installation.

Technical ContextAI

CWE-416 (Use After Free) describes a memory safety flaw where a program retains a dangling pointer to heap memory after it has been freed. In Chrome's Extensions subsystem, the affected code path fails to properly invalidate object references during the extension lifecycle - a crafted extension can trigger the premature or incorrect release of a heap object while a reference to it remains in use, enabling controlled memory corruption. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all platform variants of Chrome prior to 151.0.7922.137. Chrome's multi-process, sandboxed architecture means execution achieved via this flaw is confined to the renderer or extension process sandbox, reflected in the CVSS S:U (Scope Unchanged) metric - a sandbox escape would be required for system-level impact.

RemediationAI

Update Google Chrome to version 151.0.7922.137 or later, which contains the vendor-released patch as confirmed by the Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html. Chrome's auto-update mechanism will deliver this release to most managed and consumer endpoints; administrators on enterprise deployments should verify forced update rollout via Group Policy or Google Admin Console and confirm the running version. As a compensating control prior to patching, organizations can disable extension installation entirely via Chrome Enterprise policy (ExtensionInstallBlocklist set to '*'), though this will break existing legitimate extensions and may impact productivity. Restricting extension installation to a vetted allowlist (ExtensionInstallAllowlist) is a less disruptive alternative that prevents arbitrary third-party extension installation without fully disabling the extension ecosystem. Monitoring Chrome extension inventory via endpoint management tooling to detect newly installed extensions can provide a detection layer.