Description
Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use-after-free flaw in Chrome’s HTML rendering engine. When a crafted HTML page is processed, Chrome may access an object that has already been freed, allowing an attacker to corrupt the heap. The flaw is categorized as CWE-416 and CWE-825 and is reported as high severity by Chromium.

Affected Systems

Affected browsers are Google Chrome versions prior to 151.0.7922.109. All platforms running the stable channel of Chrome before that version are impacted.

Risk and Exploitability

The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. Chromium labels it as high severity, suggesting that delivering a malicious HTML page to a Chrome user could result in heap corruption. The likely attack vector is remote via a crafted web page, requiring only victim interaction with Chrome. No information is provided about required privileges or local code execution before the heap corruption occurs. This vulnerability carries a CVSS score of 8.8.

Generated by OpenCVE AI on August 13, 2026 at 13:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome 151.0.7922.109 or later.
  • Ensure that Chrome’s automatic update feature is enabled so future patches are applied automatically.
  • If an update cannot be applied immediately, enable Site Isolation and the Strong Sandbox Chrome features to reduce the impact of malicious page execution.

Generated by OpenCVE AI on August 13, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4728-1 chromium security update
Debian DSA Debian DSA DSA-6422-1 chromium security update
History

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Google Chrome: Arbitrary code execution via crafted HTML page
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 11 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Fri, 07 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome HTML Rendering Allows Heap Corruption

Fri, 07 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome HTML Rendering Allows Heap Corruption
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-08T03:55:37.467Z

Reserved: 2026-08-06T16:51:45.889Z

Link: CVE-2026-19144

cve-icon Vulnrichment

Updated: 2026-08-07T13:45:03.288Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-06T22:16:56.537

Modified: 2026-08-11T20:46:51.930

Link: CVE-2026-19144

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-06T20:33:45Z

Links: CVE-2026-19144 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:30:17Z

Weaknesses