What is the CVSS score of EUVD-2026-54135?

EUVD-2026-54135 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-54135?

Google Chrome versions before 151.0.7922.109 contain a critical sandbox escape in the WebAuthn component that allows remote code execution when users visit malicious web pages, affecting the entire…. A patch is available.

How to fix or mitigate EUVD-2026-54135?

Within 24 hours: Audit all Chrome installations to identify affected versions and prioritize high-risk systems (executives, sensitive roles). Within 7 days: Deploy Chrome 151.0.7922.109 or later organization-wide through your patch management system; enforce automatic updates for unmanaged endpoints. Within 30 days: Confirm patch deployment completion via asset inventory; enable Chrome update notifications and configure automatic security updates to prevent similar vulnerabilities from affecting future versions.

Google Chrome EUVD-2026-54135

| CVE-2026-19166 CRITICAL

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-wvq2-h5rv-752w

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via a web page (AV:N) with no auth (PR:N) but requiring victim interaction (UI:R); rated AC:H because 'potentially' a sandbox escape implies non-trivial heap grooming, with scope change (S:C) and high CIA from code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:26 vuln.today

CVSS changed

Aug 07, 2026 - 13:22 NVD

9.6 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Web Authentication (WebAuthn) component before 151.0.7922.109 lets a remote attacker who lures a victim to a crafted HTML page corrupt memory via a use-after-free and potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 (scope-changed), it affects the vast installed base of desktop Chrome; Google has shipped a fixed Stable-channel build. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Chrome's WebAuthn implementation handles the browser side of the FIDO2/W3C Web Authentication API, brokering credential creation and assertion requests between JavaScript on a page and platform/hardware authenticators. The root cause is CWE-416 (use-after-free): an object tied to a WebAuthn operation is freed while a dangling reference remains reachable, so subsequent access operates on reclaimed heap memory. In Chrome's multi-process model such renderer-reachable memory-corruption bugs are the classic primitive for a sandbox escape, which is consistent with the CVSS scope-change (S:C) flag indicating impact beyond the initially vulnerable component.

RemediationAI

Primary fix: update Chrome to 151.0.7922.109 or later (Vendor-released patch: 151.0.7922.109) via Chrome's built-in updater (chrome://settings/help) or managed enterprise deployment, then fully relaunch the browser so the new binary loads. In managed fleets, push the update through Google Update/Admin Console or your patch-management tooling and confirm the running version. Because exploitation requires the user to load attacker content, interim compensating controls until patching completes include restricting browsing to trusted sites via web filtering/proxy policy and warning users against untrusted links - these reduce exposure but do not eliminate the flaw and add browsing friction. Users of other Chromium-based browsers should apply their vendor's corresponding update once it rebases onto the fixed Chromium. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html.