What is the CVSS score of EUVD-2026-61233?

EUVD-2026-61233 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by EUVD-2026-61233?

Google Chrome contains a critical remote code execution vulnerability (CVSS 8.8) affecting all versions before 151.0.7922.169, putting every employee's workstation and company data at risk during…. A patch is available.

How to fix or mitigate EUVD-2026-61233?

Within 24 hours, communicate to all users the critical nature of this vulnerability and begin staging Chrome 151.0.7922.169 for deployment; for enterprise-managed Chrome instances, trigger immediate availability of the patched version through your management console. Within 7 days, deploy Chrome 151.0.7922.169 or later to all endpoints, prioritizing employee-accessible systems; verify deployment completion and enable automatic updates if not already enabled. Within 30 days, review security logs and endpoint telemetry for any exploitation attempts (e.g., unusual renderer process behavior or unexpected system changes), confirm 100% patch coverage across all devices, and document the deployment in your change management system.

Google Chrome EUVD-2026-61233

| CVE-2026-76043 HIGH

Incorrect Calculation (CWE-682)

2026-08-18 chrome-cve-admin@google.com

GHSA-wp2g-63g2-rvfw

Google RCE Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network delivery via web page (AV:N), no complexity barriers (AC:L), no privileges needed (PR:N), user must visit the page (UI:R), sandbox containment means no scope change (S:U), full browser-process impact (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 12:26 vuln.today

CVSS changed

Aug 19, 2026 - 12:23 NVD

8.8 (HIGH)

CVE Published

Aug 18, 2026 - 21:18 cve.org

HIGH 8.8

CVE Published

Aug 18, 2026 - 21:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML and JavaScript payload

Delivery

Victim lured to attacker-controlled page via phishing or malvertising

Exploit

Chrome loads page, V8 processes crafted script

Execution

Incorrect calculation triggers memory corruption in V8

Persist

Attacker achieves arbitrary code execution within renderer sandbox

Impact

Browser session data and in-process secrets accessible to attacker

Access

Attacker crafts malicious HTML and JavaScript payload

Delivery

Victim lured to attacker-controlled page via phishing or malvertising

Exploit

Chrome loads page, V8 processes crafted script

Execution

Incorrect calculation triggers memory corruption in V8

Persist

Attacker achieves arbitrary code execution within renderer sandbox

Impact

Browser session data and in-process secrets accessible to attacker

Vulnerability AssessmentAI

Exploitation	The victim must actively visit an attacker-controlled or attacker-compromised HTML page using a Chrome version prior to 151.0.7922.169 - this is the sole prerequisite for exploitation, consistent with UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: network-reachable, low complexity, no privileges required, minimal friction for the attacker, with full confidentiality, integrity, and availability impact within the browser process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing carefully crafted JavaScript designed to trigger the V8 incorrect calculation flaw. A victim using an unpatched Chrome browser is directed to the page via a phishing link, malvertising redirect, or compromised legitimate site. …
Remediation	The primary fix is to upgrade Google Chrome to version 151.0.7922.169 or later; this version is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, communicate to all users the critical nature of this vulnerability and begin staging Chrome 151.0.7922.169 for deployment; for enterprise-managed Chrome instances, trigger immediate availability of the patched version through your management console. …

Threat intelligence, references, and detailed analysis are available after sign-in.