What is the CVSS score of EUVD-2026-54116?

EUVD-2026-54116 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-54116?

Google Chrome versions prior to 151.0.7922.109 contain a critical use-after-free vulnerability in the HTML engine allowing unauthenticated remote code execution through a crafted web page, affecting…. A patch is available.

How to fix or mitigate EUVD-2026-54116?

Within 24 hours, alert all stakeholders and technical teams of the critical use-after-free vulnerability in Chrome affecting versions prior to 151.0.7922.109, emphasizing the remote code execution risk and immediate need for patching. Within 7 days, deploy Chrome version 151.0.7922.109 to all managed endpoints using your enterprise deployment mechanism (Google Admin Console for managed Chromebooks, or equivalent distribution for Windows/macOS/Linux endpoints), prioritizing business-critical systems and customer-facing applications. Within 30 days, conduct a comprehensive audit of all Chrome installations to verify 100% compliance with version 151.0.7922.109 or later, documenting any unpatched systems and escalating non-compliant devices for remediation.

Google Chrome EUVD-2026-54116

| CVE-2026-19144 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-2h3c-w28j-pv5p

Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via web page, no auth or special config needed, single user interaction (UI:R) required; heap corruption yields full C/I/A within the renderer; scope unchanged due to sandbox boundary.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:23 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's HTML engine (all versions prior to 151.0.7922.109) exposes users to potential heap corruption and code execution when they visit a crafted HTML page. The CVSS 8.8 score reflects unauthenticated, network-reachable exploitation requiring only a single user interaction - consistent with Chromium's own 'High' severity classification. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch (151.0.7922.109) has been released and is the primary mitigation.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory-safety flaw where code references a heap object after that object has been freed, potentially allowing an attacker to control the contents of reclaimed memory and redirect execution. This instance resides in Chrome's HTML processing subsystem - likely the Blink rendering engine, which parses and evaluates HTML content. Use-after-free bugs in browser rendering pipelines are particularly dangerous because renderer processes handle untrusted, attacker-controlled content from the web; heap grooming techniques can turn UAF primitives into reliable read/write/execute primitives. Affected CPE is implicitly chrome versions < 151.0.7922.109 on desktop platforms (Windows, macOS, Linux), as reported via EUVD-2026-54116 with the affected version range 'Chrome 151.0.7922.109 < 151.0.7922.109'.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.109 or later immediately; this is a vendor-released patch confirmed by the Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's auto-update mechanism will apply this patch on the next browser restart for most managed and consumer installations - verify by checking chrome://settings/help. For enterprise environments where Chrome version is centrally managed (via Group Policy or a mobile device management platform), push the updated installer or MSI/PKG package without delay. If immediate patching is operationally blocked, a compensating control is to enforce Chrome's Site Isolation feature (chrome://flags/#site-isolation-trial-opt-out disabled) and restrict browsing to allowlisted domains via proxy filtering, reducing the attack surface; however, this does not eliminate the vulnerability and has operational trade-offs including breakage of some cross-origin content. Browser-level sandboxing (already enabled by default) partially limits blast radius but is not a substitute for patching, as Scope:Unchanged in the CVSS vector reflects only the rendering layer and does not preclude renderer compromise.