CVE-2026-19558: Google Chrome Use-After-Free Vulnerability

CVE-2026-19558 Overview

CVE-2026-19558 is a use-after-free vulnerability [CWE-416] in the Extensions component of Google Chrome versions prior to 151.0.7922.137. An attacker who convinces a user to install a malicious extension can execute arbitrary code inside the Chrome sandbox through a crafted Chrome Extension. Google's Chromium security team rated this issue as High severity.

The flaw requires user interaction, specifically the installation of a malicious browser extension. Successful exploitation grants code execution within the renderer sandbox, which attackers commonly chain with sandbox escape vulnerabilities to reach the host operating system.

Critical Impact
Arbitrary code execution inside the Chrome sandbox via a crafted extension, enabling potential browser compromise and pivoting toward host-level access when combined with a sandbox escape.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.137
Chromium-based browsers incorporating the vulnerable Extensions component
All supported desktop platforms (Windows, macOS, Linux) running the affected Chrome builds

Discovery Timeline

2026-08-11 - CVE-2026-19558 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19558

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within Chrome's Extensions subsystem. Use-after-free flaws occur when a program continues to reference memory after it has been released, allowing an attacker to control the freed memory region and influence subsequent operations.

In this case, a crafted Chrome Extension triggers the dangling reference during its interaction with the Extensions component. The attacker gains arbitrary code execution inside the renderer or extension process sandbox. While the sandbox limits direct access to the host, code execution at this layer provides a foundation for further exploitation.

The attack requires the victim to install the malicious extension. This constraint raises the exploitation complexity compared to drive-by browser flaws but remains realistic given continued abuse of the Chrome Web Store and sideloaded enterprise extensions.

Root Cause

The root cause is improper lifetime management of an object within the Extensions component. Code paths retain a pointer to an object after the underlying memory has been freed, then dereference that pointer during later extension operations. An attacker who controls extension code can shape heap layout to place attacker-controlled data at the freed address.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker publishes or distributes a malicious Chrome Extension and convinces a target to install it. Once installed, the extension triggers the vulnerable code path in the Extensions component and executes arbitrary code within the sandbox. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor details.

Detection Methods for CVE-2026-19558

Indicators of Compromise

Installation of Chrome extensions from outside approved enterprise allowlists or from unfamiliar publishers.
Chrome renderer or extension host process crashes referencing the Extensions component in crash dumps.
Unexpected outbound network connections originating from Chrome extension processes.
Modifications to the Chrome Extensions and Preferences files without corresponding user-initiated installations.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist.
Monitor Chrome process telemetry for abnormal child process creation or memory access patterns following extension events.
Correlate browser version telemetry with the fixed Chrome build 151.0.7922.137 to identify unpatched hosts.

Monitoring Recommendations

Enable enterprise reporting through Chrome Browser Cloud Management to receive extension install and crash events.
Forward Chrome crash reports and endpoint process telemetry to a central data lake for correlation.
Alert on newly installed extensions with broad permissions such as <all_urls>, debugger, or nativeMessaging.

How to Mitigate CVE-2026-19558

Immediate Actions Required

Update Google Chrome to version 151.0.7922.137 or later on all desktop endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded.
Audit installed extensions and remove any that are unnecessary, unverified, or outside the approved catalog.
Enforce enterprise extension policies through Chrome Enterprise or equivalent management tooling.

Patch Information

Google addressed CVE-2026-19558 in Chrome 151.0.7922.137 for the Stable channel on Desktop. See the Google Chrome Desktop Update for the full release notes and the Chromium Issue Tracker Entry for issue metadata. Chromium-based browsers should apply the upstream fix in their respective releases.

Workarounds

Restrict extension installation to an enterprise-managed allowlist via the ExtensionInstallAllowlist policy.
Block installation of extensions from sources other than the Chrome Web Store using ExtensionInstallSources.
Disable developer mode extensions and sideloading on managed endpoints.
Train users to avoid installing extensions from unfamiliar publishers or unsolicited links.

bash

# Configuration example: Chrome enterprise policy to restrict extensions (Linux JSON policy)
# Path: /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionInstallSources": [
    "https://clients2.google.com/service/update2/crx"
  ],
  "DeveloperToolsAvailability": 2
}