What is the CVSS score of CVE-2026-15107?

CVE-2026-15107 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15107?

Google Chrome versions before 150.0.7871.115 contain a remote code execution vulnerability allowing attackers to compromise user systems through malicious web pages without user authentication.. A patch is available.

How to fix or mitigate CVE-2026-15107?

Within 24 hours: Audit Chrome versions deployed across endpoints and confirm all systems running versions below 150.0.7871.115; issue critical update notification to all users. Within 7 days: Deploy Chrome 150.0.7871.115 or later organization-wide using your standard software distribution mechanism. Within 30 days: Verify 100% deployment completion, confirm zero systems remain on vulnerable versions, and establish 150.0.7871.115+ as the new security baseline.

Google Chrome CVE-2026-15107

EUVD-2026-42459 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-rmv3-p6fw-xh3h

RCE Denial Of Service Google Use After Free Memory Corruption Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable from any web page with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); execution stays in the sandboxed renderer so S:U with high renderer C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:33 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Renderer-process code execution in Google Chrome desktop before 150.0.7871.115 arises from a use-after-free in the IndexedDB implementation, letting a remote attacker run arbitrary code within the Chromium sandbox when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity even though the CVSS base score is 8.8, reflecting that execution is confined to the sandboxed renderer rather than the host. A vendor patch is available and no public exploit has been identified at time of analysis.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's IndexedDB subsystem, the browser's transactional client-side object store implemented in the Blink/content renderer. A UAF occurs when a heap object is freed while a dangling reference remains, allowing an attacker who controls subsequent heap allocations (via crafted JavaScript IndexedDB operations) to groom memory and corrupt object state, ultimately steering control flow. Because IndexedDB is exposed to any web origin through standard JavaScript APIs, the vulnerable code path is reachable directly from untrusted page content. Per CPE/EUVD data the affected component is the Chrome desktop stable channel prior to 150.0.7871.115; the exploit executes inside the renderer sandbox, so on its own it does not yield host-level compromise without a separate sandbox-escape chain.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later on all desktop platforms; most installations receive this automatically, so verify the update applied via chrome://settings/help and relaunch the browser to complete it, since the running process retains the vulnerable code until restart. In managed fleets, push the update through your enterprise policy/MDM channel and confirm the minimum version is enforced. Chromium-based browsers should be updated to whichever release incorporates the fixed Chromium base. If patching must be briefly delayed, the practical compensating control is to restrict browsing of untrusted sites and enforce Chrome's site-isolation and sandbox (both default-on) - do not disable them; there is no supported way to selectively disable IndexedDB without breaking many legitimate web apps, so upgrading is the only reliable fix. Reference: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html.