What is the CVSS score of EUVD-2026-54137?

EUVD-2026-54137 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-54137?

Google Chrome on Windows (versions prior to 151.0.7922.109) contains a critical sandbox escape vulnerability (CVE-2026-19171, CVSS 9.6) that allows remote attackers to execute arbitrary code with…. A patch is available.

How to fix or mitigate EUVD-2026-54137?

Within 24 hours, create an inventory of all Windows systems running Chrome versions prior to 151.0.7922.109 and assess your organization's exposure through browser telemetry or endpoint management tools; immediately notify all users of the criticality and advise against untrusted websites. Within 7 days, deploy Google Chrome version 151.0.7922.109 or later across all affected Windows systems using your standard change management process, prioritizing systems with privileged users or network access. Within 30 days, validate 100% patch compliance across all systems through endpoint scanning, review security logs for any exploitation attempts during the pre-patch window, and document the incident response timeline.

Google Chrome EUVD-2026-54137

| CVE-2026-19171 CRITICAL

Use After Free (CWE-416)

2026-08-06 chrome-cve-admin@google.com

GHSA-j855-4985-fgj7

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); sandbox escape changes scope (S:C) with full host impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:26 vuln.today

CVSS changed

Aug 07, 2026 - 13:22 NVD

9.6 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Media component on Windows (versions prior to 151.0.7922.109) lets a remote attacker break out of the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 9.6 because a successful escape yields full confidentiality, integrity, and availability impact beyond the sandboxed process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome UAF media bugs are historically attractive targets.

Technical ContextAI

The defect lives in Chrome's Media subsystem, the pipeline responsible for decoding and rendering audio/video content delivered through HTML (e.g., <video>/<audio> elements, Media Source Extensions, and codec handling). CWE-416 use-after-free means an object in this pipeline is freed while a dangling pointer to it remains reachable; subsequent use of that pointer allows an attacker who controls heap layout to redirect execution or corrupt memory. Because the reported impact is a sandbox escape with a changed scope, the bug is powerful enough for code running in the media/renderer context to affect the host process boundary. No CPE strings were supplied, but the EUVD affected-version data ('Chrome 151.0.7922.109 <151.0.7922.109') and the Chrome stable-channel advisory scope this to the Windows desktop build.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.109 for Windows - upgrade to this build or later via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, per the stable-channel advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html). In managed environments, push the update through your Chrome enterprise policy/update infrastructure and force a browser restart, since the fix is inert until relaunch. If patching cannot be completed immediately, compensating controls include restricting browsing to trusted sites via enterprise URL allow-listing and disabling autoplay/untrusted media where feasible to reduce exposure of the Media pipeline - with the trade-off of degraded user experience and no guarantee the UAF is unreachable through other media paths. Users of Chromium-based browsers should apply the equivalent vendor build once released. No standalone workaround fully substitutes for the patch.