What is the CVSS score of EUVD-2026-56987?

EUVD-2026-56987 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-56987?

Google Chrome versions prior to 151.0.7922.137 contain a critical memory corruption vulnerability (CVE-2026-19560, CVSS 8.8) that enables unauthenticated attackers to execute arbitrary code when…. A patch is available.

How to fix or mitigate EUVD-2026-56987?

Within 24 hours, scan all corporate endpoints using your MDM or patch management system to identify systems running Chrome versions prior to 151.0.7922.137 and establish a prioritized remediation list. Within 7 days, deploy Chrome 151.0.7922.137 or later organization-wide using your standard patch deployment process, enabling automatic updates to ensure continuous protection; prioritize high-risk user groups and systems handling sensitive data. Within 30 days, conduct a compliance audit to verify 100% patch coverage, remediate any remaining vulnerable systems, and document the incident response for regulatory records and future patch management improvements.

Google Chrome EUVD-2026-56987

| CVE-2026-19560 HIGH

Use After Free (CWE-416)

2026-08-11 Chrome

GHSA-pj49-8f7r-jv2r

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted page (AV:N), low complexity UAF (AC:L), no prior authentication (PR:N), single user interaction needed (UI:R), sandbox-scoped impact (S:U), full confidentiality/integrity/availability within renderer (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 14:24 vuln.today

CVSS changed

Aug 12, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Aug 11, 2026 - 21:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 11, 2026 - 21:23 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.

Technical ContextAI

Blink is Chrome's HTML/CSS rendering engine, forked from WebKit. CWE-416 (Use After Free) describes a class of memory corruption bugs where freed heap memory is accessed again, allowing attackers to control dangling pointers and redirect execution. In browser rendering engines, UAF vulnerabilities frequently arise in DOM node lifecycle management, garbage collection races, or event handler teardown. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop variants across platforms. Exploitation lands code inside the browser's renderer sandbox, meaning a second sandbox escape would be needed for full OS compromise - but renderer-level RCE is itself a significant capability enabling further attacks.

RemediationAI

Update Google Chrome to version 151.0.7922.137 or later immediately; this is a vendor-confirmed patch documented at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html. Chrome's auto-update mechanism will apply this for most users, but enterprise deployments using managed update channels should force the update via policy. As a compensating control prior to patching, consider enabling Enhanced Safe Browsing to reduce delivery of malicious pages, and restrict browsing to trusted sites via URL filtering in corporate proxy environments - though neither control eliminates the risk of a crafted page reaching the browser. Chromium-based browsers should be updated to versions incorporating the same upstream Blink fix once available from their respective vendors.