CVE-2026-19156 is a heap buffer overflow vulnerability in the Base component of Google Chrome before version 151.0.7922.109. An attacker could exploit this by tricking a user into installing a crafted malicious Chrome extension, which may cause heap corruption. The vulnerability is identified as CWE-122 (Heap-based Buffer Overflow). There is no CVSS score available, and no known active exploitation has been reported. The vulnerability affects only versions prior to 151.0.7922.109.

Successful exploitation could lead to heap corruption within the Chrome process, potentially allowing an attacker to execute arbitrary code or cause a denial of service. However, exploitation requires user interaction in the form of installing a malicious extension. No known exploits in the wild have been reported.

Users and administrators should update Google Chrome to version 151.0.7922.109 or later to remediate this vulnerability. Since this is a client-side vulnerability requiring user installation of a malicious extension, avoiding installation of untrusted extensions also reduces risk. Patch status is confirmed by the version boundary; updating to the fixed version is the recommended remediation.