What is the CVSS score of CVE-2026-76040?

CVE-2026-76040 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-76040?

Google Chrome on macOS (versions prior to 151.0.7922.169) contains a critical vulnerability (CVE-2026-76040) enabling remote code execution by circumventing application sandboxing protections.. A patch is available.

How to fix or mitigate CVE-2026-76040?

Within 24 hours, identify all macOS systems running Chrome and notify users of the critical update requiring prompt installation. Within 7 days, deploy Chrome 151.0.7922.169 or later through your standard patch management process to all macOS endpoints, with verification of successful deployment. Within 30 days, confirm 100% deployment completion through inventory audits, establish monitoring for suspicious Chrome process behavior, and conduct user awareness training on web-based social engineering tactics.

Google Chrome CVE-2026-76040

EUVD-2026-61229 HIGH

Use After Free (CWE-416)

2026-08-18 chrome-cve-admin@google.com

GHSA-j938-c23g-prvh

Use After Free Google Memory Corruption RCE Denial Of Service Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted page (AV:N), no special conditions (AC:L), no attacker auth needed (PR:N), requires user click (UI:R); full host impact but no scope change since Browser process is the target.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 12:25 vuln.today

CVSS changed

Aug 19, 2026 - 12:23 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Aug 18, 2026 - 21:18 cve.org

HIGH 8.8

CVE Published

Aug 18, 2026 - 21:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page

Delivery

Deliver link via phishing or compromised site

Exploit

Victim visits page in unpatched Chrome on macOS

Execution

Trigger use-after-free in Browser process

Impact

Execute arbitrary code outside sandbox

Access

Craft malicious HTML page

Delivery

Deliver link via phishing or compromised site

Exploit

Victim visits page in unpatched Chrome on macOS

Execution

Trigger use-after-free in Browser process

Impact

Execute arbitrary code outside sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim is running Google Chrome on macOS with a version below 151.0.7922.169. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 score reflects a network-reachable, unauthenticated (PR:N), user-interaction-required (UI:R) attack with high confidentiality, integrity, and availability impact and no scope change (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that triggers a use-after-free condition in Chrome's Browser process on macOS, then distributes the link via phishing email or compromised website. A targeted user on macOS is socially engineered into visiting the page in an unpatched Chrome session. …
Remediation	Update Google Chrome on macOS to version 151.0.7922.169 or later, which is confirmed as the patched release per the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. … Detailed patch versions, workarounds, and compensating controls in full report.