Loading vulnerability…
Use-after-free in Google Chrome Payments
CVE-2026-19175 is a use-after-free vulnerability in the Payments component of Google Chrome before version 151.0.7922.109. A remote attacker could potentially exploit the flaw through a crafted HTML page to escape the browser sandbox. Chromium classifies the vulnerability as High severity. The specific affected function and memory-lifetime conditions are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could potentially bypass Chrome's sandbox isolation, compromising the security boundary that restricts browser processes. Arbitrary code execution, information disclosure, and denial of service are described for the broader set of accompanying vulnerabilities, but are not independently established for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, reduce exposure to untrusted web content through URL filtering and browsing restrictions, enable available exploit protections, and enforce least privilege. These measures reduce risk but do not correct the use-after-free flaw.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later, restart the browser, and verify that the updated version is active across managed devices. For ChromeOS, install ChromeOS 151 version 16733.48.0, containing browser version 151.0.7922.141, or a later supported release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.