What is the CVSS score of EUVD-2026-56986?

EUVD-2026-56986 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-56986?

Google Chrome versions prior to 151.0.7922.137 contain a critical vulnerability enabling remote code execution on employee devices through malicious websites; no public exploits have been identified…. A patch is available.

How to fix or mitigate EUVD-2026-56986?

Within 24 hours, identify all Chrome deployments across your organization using deployment tracking tools or endpoint management systems. Within 7 days, deploy Chrome version 151.0.7922.137 or later to all user systems through your standard patch management process, prioritizing laptops and desktops with elevated data access. Within 30 days, verify patch deployment completion using endpoint telemetry and conduct spot checks on a sample of systems to confirm all Chrome instances have been updated.

Google Chrome EUVD-2026-56986

| CVE-2026-19559 HIGH

Use After Free (CWE-416)

2026-08-11 Chrome

GHSA-7jqm-vj2p-424m

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via any webpage (AV:N/AC:L/PR:N), requires only a page visit (UI:R), and execution stays sandboxed with full renderer-scoped impact (S:U/C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:31 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Aug 11, 2026 - 21:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 11, 2026 - 21:23 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.

Technical ContextAI

The vulnerability is classified as CWE-416 (Use After Free), occurring within Chrome's HTML rendering engine. Use-after-free flaws arise when the browser frees a heap-allocated object but retains a dangling pointer to it; subsequent access through that pointer enables controlled heap corruption, which experienced exploit developers can weaponize for code execution. Chrome's multi-process architecture isolates rendering in a sandboxed subprocess, meaning exploitation achieves code execution within that sandbox rather than directly in a privileged host context. Chaining a separate sandbox escape would be required for full OS compromise. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions below 151.0.7922.137. CWE-416 class flaws in browser rendering engines have a well-documented history of being used as the first stage in exploit chains targeting full device takeover.

RemediationAI

Update Google Chrome to version 151.0.7922.137 or later using Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or via the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html. Enterprise administrators should push the update through MDM, Group Policy, or the Google Chrome Browser Cloud Management console without delay, prioritizing internet-facing endpoints and high-value user systems. For organizations unable to patch immediately, enabling Chrome's Enhanced Safe Browsing mode reduces exposure to known-malicious pages at the cost of sharing additional browsing metadata with Google. Restricting employee browsing to allowlisted domains via enterprise proxy or content filtering provides a compensating control that reduces the likelihood of a victim reaching a crafted page, though it does not eliminate the vulnerability. Chromium-based browsers should be monitored for their own downstream patch releases based on this Chromium fix.