What is the CVSS score of CVE-2026-6919?

CVE-2026-6919 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-6919?

Google Chrome desktop users across the organization running versions prior to 147.0.7727.117 are potentially at risk from a critical sandbox escape vulnerability that could enable privilege…. A patch is available.

How to fix or mitigate CVE-2026-6919?

Within 24 hours, inventory Chrome versions across the organization and notify end users of the required update. Within 7 days, deploy Chrome version 147.0.7727.117 or later through your software update platform using staged rollout to minimize business disruption. Within 30 days, confirm deployment completion and validate compliance through endpoint management tools.

Google Chrome CVE-2026-6919

EUVD-2026-25251 CRITICAL

Use After Free (CWE-416)

2026-04-23 Chrome

GHSA-cxc8-7952-8cj3

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R because exploitation requires a pre-compromised renderer plus victim visiting a crafted page; S:C and full C/I/A reflect the sandbox escape into the higher-privileged browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 24, 2026 - 16:39 nvd

Patch available

Re-analysis Queued

Apr 24, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 14:22 NVD

9.6 (CRITICAL)

Patch available

Apr 23, 2026 - 19:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25251

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 16:12 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's DevTools component (versions prior to 147.0.7727.117) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, this is a use-after-free (CWE-416) that serves as the second link in a multi-stage exploit chain rather than a standalone remote code execution. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records no observed exploitation, so it is a patch-and-move-on desktop browser fix rather than an emergency.

Technical ContextAI

The flaw lives in Chrome's DevTools, the built-in debugging and inspection subsystem that is privileged relative to ordinary web content and communicates with the browser process. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that reference lets an attacker with control of the renderer manipulate freed memory to corrupt state across the renderer/browser trust boundary. Because DevTools bridges the sandboxed renderer and the higher-privileged browser process, a memory-corruption bug there is a classic sandbox-escape primitive. The single CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirms the affected product is the Chrome desktop application across the vulnerable version range; the underlying Blink/Chromium engine is shared with Chromium-based browsers (Edge, Brave, Opera, Electron), which typically require separate downstream fixes.

RemediationAI

Vendor-released patch: 147.0.7727.117. Update Google Chrome to 147.0.7727.117 or later on all desktop platforms and restart the browser so the new version takes effect (Chrome applies the update on relaunch); managed fleets should push the version via enterprise policy/auto-update and verify the running build. There is no configuration-only workaround for the memory bug itself, but as a compensating control you can reduce exposure of the DevTools attack surface - enterprise administrators can restrict or disable DevTools via the DeveloperToolsAvailability policy, which blocks the vulnerable component for managed users at the cost of removing debugging capability for developers. Consult the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html and tracking references https://nvd.nist.gov/vuln/detail/CVE-2026-6919 and https://vuldb.com/vuln/359166 for release confirmation.