Description
Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-06
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free vulnerability in the Views component of Google Chrome on Windows can lead to heap corruption when a user interacts with a specially crafted HTML page. The flaw is a memory‑management error (CWE‑416) that may allow an attacker to execute arbitrary code on the victim’s machine. This issue also involves an improperly handled resource cleanup (CWE‑825).

Affected Systems

Google Chrome for Windows versions earlier than 151.0.7922.109 are affected. Users running those builds should update their browser to mitigate the issue.

Risk and Exploitability

The exploit requires a remote attacker to host a malicious web page and convince a user to perform specific UI gestures within Chrome, a scenario that is feasible for phishing or drive‑by websites. The EPSS score is < 1% and the CVSS score is 7.5, classifying the vulnerability as high severity; it is not listed in the CISA KEV catalog, but the Chromium security team rates it as High. Given the potential for arbitrary code execution and the realistic attack vector, the risk to affected systems remains significant.

Generated by OpenCVE AI on August 13, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 151.0.7922.109 or later.
  • Restart Chrome after applying the update to ensure no stale references remain.
  • Avoid interacting with suspicious or untrusted web pages that require user gestures until the upgrade is applied.

Generated by OpenCVE AI on August 13, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4728-1 chromium security update
Debian DSA Debian DSA DSA-6422-1 chromium security update
History

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Google Chrome: Arbitrary code execution via use-after-free in Views
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 07 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Title Use-after-Free Heap Corruption in Chrome Views on Windows

Fri, 07 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 07 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Use-after-Free Heap Corruption in Chrome Views on Windows

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-08T03:55:36.240Z

Reserved: 2026-08-06T16:51:49.601Z

Link: CVE-2026-19158

cve-icon Vulnrichment

Updated: 2026-08-07T13:29:05.579Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-06T22:16:58.123

Modified: 2026-08-08T05:17:08.377

Link: CVE-2026-19158

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-06T20:33:50Z

Links: CVE-2026-19158 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T14:00:04Z

Weaknesses