CVE-2026-19145 in Chrome
Summary
by MITRE • 08/07/2026
Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical use-after-free condition in the translation functionality of google chrome browser versions prior to 151.0.7922.109. The flaw occurs within the browser's sandboxed environment where memory management errors can potentially be exploited by remote attackers. The vulnerability is classified as high severity according to chromium security standards and falls under the common weakness enumeration category CWE-416 which specifically addresses use-after-free conditions. The attack vector involves a remote adversary crafting a malicious html page that triggers the vulnerable translation component, allowing for arbitrary code execution within the sandboxed context.
The technical implementation of this vulnerability stems from improper memory management during translation operations where allocated memory blocks are freed but subsequently accessed through dangling pointers. When chrome processes translated content, it maintains references to memory locations that may be deallocated while still being referenced by active translation components. This creates a window of opportunity for attackers to manipulate the memory state and redirect execution flow. The sandbox environment which typically isolates browser processes from the underlying operating system becomes compromised when this vulnerability is successfully exploited.
The operational impact of this vulnerability extends beyond simple code execution as it fundamentally undermines the security model of modern web browsers. Attackers can leverage this flaw to bypass sandbox protections that are designed to contain malicious activities within isolated environments. The remote nature of the attack means that users do not need to perform any specific actions beyond visiting a compromised webpage, making the vulnerability particularly dangerous in phishing campaigns or compromised websites. This type of exploit aligns with attack patterns documented in the mitre att&ck framework under the technique identifier t1059 which covers command and scripting interpreter usage.
Mitigation strategies for this vulnerability require immediate browser updates to versions 151.0.7922.109 or later where memory management has been corrected through proper reference counting and null pointer validation. Organizations should implement network-level protections such as content filtering systems that can detect and block known malicious html patterns associated with translation component exploitation. Additionally, browser hardening measures including disabling unnecessary translation features for high-risk environments can reduce attack surface. The fix typically involves implementing proper memory lifecycle management where freed memory blocks are immediately invalidated and all references are properly cleared to prevent dangling pointer access. Security teams should also monitor for any related vulnerabilities in similar translation or internationalization components that might present analogous use-after-free conditions.