CVE-2026-19167 Google CVE debrief

Who should care

Users of Google Chrome, especially those who handle sensitive data or are concerned about cross-origin data leaks, should be aware of this vulnerability and ensure that their browser is updated to the latest version. Additionally, security teams and vulnerability management teams should prioritize patching to prevent potential data leaks. Operators of Google Chrome, especially those in sensitive industries, should review their configurations and ensure that compensating controls are in place for exposed systems.

Technical summary

The vulnerability is an integer overflow in the GPU of Google Chrome, which occurred prior to version 151.0.7922.109. This allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. The technical impact of this vulnerability is that an attacker could potentially access sensitive data from other origins, which could lead to further exploitation. It is essential to update Google Chrome to the latest version to prevent potential data leaks.

Defensive priority

This vulnerability has a CVSS score of 3.1 and is considered LOW severity. However, it is still important to prioritize patching to prevent potential data leaks.

Recommended defensive actions

• Apply the patch for Google Chrome to version 151.0.7922.109 or later
• Ensure that Google Chrome is updated to the latest version
• Monitor for any suspicious activity related to cross-origin data leaks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates an integer overflow in GPU in Google Chrome prior to 151.0.7922.109, which allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity is High. This information is based on the CVE record and NVD detail. However, the actual impact and affected scope may vary depending on the specific deployment and configurations. Defenders should verify the patch status of their Google Chrome installations and review compensating controls for exposed systems.

Official resources