Loading vulnerability…
Use-after-free in Google Chrome V8
CVE-2026-19151 is a high-severity use-after-free vulnerability in the V8 engine in Google Chrome before version 151.0.7922.109. A remote attacker can trigger the vulnerability through a crafted HTML page, allowing arbitrary code execution inside the Chrome sandbox. The specific vulnerable function and object-lifetime conditions are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attacker-controlled code to execute within the Chrome sandbox. This vulnerability alone does not establish sandbox escape, host-level code execution, or elevated privileges.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict access to untrusted websites and web content using browser policies and URL filtering. Maintain browser sandboxing and exploit-protection features, and run browsers under nonadministrative accounts as defense in depth. No vulnerability-specific workaround is identified.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later, or install the applicable vendor-designated fixed release for the platform and release channel. For Debian 13 (trixie), upgrade the chromium package to 151.0.7922.108-1~deb13u1 or later. Restart the browser to activate the update and verify deployment across managed devices.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.