What is the CVSS score of CVE-2026-76045?

CVE-2026-76045 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-76045?

A critical vulnerability in Google Chrome (CVE-2026-76045) enables remote code execution within the browser sandbox when users visit a malicious webpage-requiring only a single visit with no…. A patch is available.

How to fix or mitigate CVE-2026-76045?

Within 24 hours, verify current Chrome version distribution across the organization and notify all users to update to Chrome 151.0.7922.169 or later. Within 7 days, enforce automatic updates through mobile device management (MDM), Group Policy (for Windows), or equivalent administrative controls to ensure all Chrome instances are patched, and conduct spot-check verification on at least 10% of endpoints to confirm patching success. Within 30 days, complete a comprehensive audit of all Chrome deployments including enterprise workstations, personal devices, containers, and development systems to document 100% patching compliance and establish automated monitoring to flag any versions falling below 151.0.7922.169.

Google Chrome CVE-2026-76045

EUVD-2026-61237 HIGH

Use After Free (CWE-416)

2026-08-18 chrome-cve-admin@google.com

GHSA-hxrw-8g4m-h272

Use After Free Google Memory Corruption RCE Denial Of Service Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Matches provided vector: network-reachable via crafted page (AV:N), default WebGL enabled (AC:L), unauthenticated (PR:N), page visit required (UI:R), sandboxed renderer scope unchanged (S:U), full C/I/A within sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 12:27 vuln.today

CVSS changed

Aug 19, 2026 - 12:23 NVD

8.8 (HIGH)

CVE Published

Aug 18, 2026 - 21:18 cve.org

HIGH 8.8

CVE Published

Aug 18, 2026 - 21:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML with WebGL exploit payload

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome renderer parses and executes WebGL content

Execution

Use-after-free corrupts heap memory in renderer process

Impact

Attacker achieves arbitrary code execution inside Chrome sandbox

Access

Attacker crafts malicious HTML with WebGL exploit payload

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome renderer parses and executes WebGL content

Execution

Use-after-free corrupts heap memory in renderer process

Impact

Attacker achieves arbitrary code execution inside Chrome sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.169 and to navigate to a crafted HTML page - this is the sole required user interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals a network-reachable, low-complexity attack requiring only that a victim visit a malicious page - a trivially achievable social engineering barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and hosts a webpage containing crafted WebGL shader or buffer operations designed to trigger a use-after-free in Chrome's graphics processing logic. A victim is directed to this page via a phishing email, malvertising network, or a compromised legitimate site; upon rendering the page, Chrome's WebGL engine processes the malicious content, corrupts heap memory, and allows the attacker to redirect execution - achieving arbitrary code execution within the Chrome renderer sandbox. …
Remediation	Upgrade Google Chrome to version 151.0.7922.169 or later - this is the vendor-released patch as confirmed by the stable channel advisory at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, verify current Chrome version distribution across the organization and notify all users to update to Chrome 151.0.7922.169 or later. …

Threat intelligence, references, and detailed analysis are available after sign-in.