CVE-2026-19154
HIGH 8.3 ALL-YEARSUse after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Severe if exploited (CVSS 8.3), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 28th percentile
Impact if exploited
8.3CVSS 3.1 · HIGH · ADP
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-416: Use after free
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 117 vendor product statements; 85 omitted. Read the full vendor advisory.
webkit2gtk3-0:2.54.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-debuginfo-0:2.54.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-debugsource-0:2.54.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-devel-debuginfo-0:2.54.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-0:2.54.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-debuginfo-0:2.54.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-devel-debuginfo-0:2.54.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-0:2.54.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-debuginfo-0:2.54.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-devel-0:2.54.0-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-devel-debuginfo-0:2.54.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-debuginfo-0:2.54.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-devel-0:2.54.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkit2gtk3-jsc-devel-debuginfo-0:2.54.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
webkitgtk as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/webkitgtk
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Out of support scope
webkitgtk-devel as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/webkitgtk-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Out of support scope
webkitgtk-doc as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/webkitgtk-doc
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Out of support scope
webkitgtk.src as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/webkitgtk?arch=src
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Out of support scope
firefox as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00firefox as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00firefox.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox?arch=src
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk3 as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk3
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk3-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk3-devel
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk3.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk3?arch=src
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk4 as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk4
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk4-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk4-doc
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk4-jsc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk4-jsc
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk4-plugin-process-gtk2 as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk4-plugin-process-gtk2
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00webkitgtk4.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/webkitgtk4?arch=src
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00firefox.src as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox?arch=src
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00firefox as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00firefox.src as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not in execute path
pkg:rpm/redhat/firefox?arch=src
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Chrome | < 151.0.7922.109 |
All CVSS metrics
- HIGH 8.3 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - HIGH 8.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
Advisories
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html CVE record · Chrome · Updated 2026-08-06T20:33:39.289Z
NVD · CVE-2026-19154 · Updated 2026-10-23T21:10:00.157
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19154.json Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54265 EUVD · EUVD-2026-54265
Technical & other
- https://issues.chromium.org/issues/532941869 CVE record · Chrome · Updated 2026-08-06T20:33:39.289Z
NVD · CVE-2026-19154 · Updated 2026-10-23T21:10:00.157
Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00 - https://access.redhat.com/security/cve/CVE-2026-19154 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2512231 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-19154 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-19154 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://access.redhat.com/errata/RHSA-2026:74084 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
- https://access.redhat.com/errata/RHSA-2026:69098 Red Hat · CVE-2026-19154 · Updated 2026-10-16T11:16:02+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS