What is the CVSS score of EUVD-2026-54127?

EUVD-2026-54127 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-54127?

Google Chrome on Windows contains a use-after-free vulnerability in the Views UI framework that enables heap corruption and complete system compromise if users are tricked into performing specific…. A patch is available.

How to fix or mitigate EUVD-2026-54127?

Within 24 hours, identify and catalog all Google Chrome installations on Windows endpoints and assess deployment tooling (WSUS, MDM, etc.) to prepare for patch distribution. By day 7, deploy Chrome version 151.0.7922.109 or later to at least 80% of Windows enterprise endpoints, prioritizing systems with user-facing roles. Complete enterprise-wide deployment to 100% of Windows endpoints by day 30, with remaining instances cleared through policy enforcement, device compliance checks, or deprecation of unsupported endpoints.

Google Chrome EUVD-2026-54127

| CVE-2026-19158 HIGH

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-49ff-8x5v-9f8c

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:N and PR:N confirmed by web-delivered attack; AC:H because specific user gesture sequence is required beyond attacker control; UI:R mandatory; full C/I/A impact consistent with heap corruption enabling code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:24 vuln.today

CVSS changed

Aug 07, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's Views UI framework on Windows, fixed in version 151.0.7922.109, exposes users to heap corruption with full confidentiality, integrity, and availability impact. Exploitation requires convincing a target to perform specific UI gestures while visiting a crafted HTML page, making this a social-engineering-dependent but high-consequence flaw. No public exploit code or CISA KEV listing has been identified at the time of analysis; however, the severity and platform breadth make patching urgent for Windows enterprise fleets.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory-safety flaw where code references a heap-allocated object after it has been freed, potentially allowing an attacker to control that memory region and redirect execution. The affected component is Chrome's 'Views' framework - the cross-platform UI rendering layer responsible for managing UI widgets, windows, and layout elements within the browser shell. On Windows, Views interacts tightly with the Win32 messaging and event-dispatch system, and a sequence of crafted UI gestures (e.g., drag operations, focus changes, or widget lifecycle transitions) can cause a Views object to be freed while a dangling reference to it remains in use, leading to heap corruption. The vulnerability is Windows-specific, suggesting a platform-dependent code path in the Views event handler or layout engine.

RemediationAI

Update Google Chrome on Windows to version 151.0.7922.109 or later, which contains the vendor-released patch. The official advisory is available at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify rollout via Google Admin Console or push the update via their endpoint management tooling. If immediate patching is not feasible, a compensating control is to enforce Chrome's site isolation policy (already default in modern Chrome) and consider blocking access to untrusted or uncategorized web destinations via proxy policy, which raises the bar for delivering the crafted page - though this does not eliminate the risk. Disabling JavaScript is an extreme workaround that would break most web functionality and is not recommended for general use.