What is the CVSS score of CVE-2026-15108?

CVE-2026-15108 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-15108?

Yes, a patch is available for CVE-2026-15108. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-15108

EUVD-2026-42480 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-08 chrome-cve-admin@google.com

GHSA-6p2r-gg8g-33f2

Buffer Overflow Google Integer Overflow Red Hat Suse

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

UI:R reflects mandatory extension installation by victim; C:L reflects bounded out-of-bounds read only; I:N and A:N confirmed by no write or crash impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:13 vuln.today

CVE Published

Jul 08, 2026 - 23:16 cve.org

MEDIUM 4.3

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Extensions API in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Integer overflow in Google Chrome's Extensions API (versions prior to 150.0.7871.115) enables an out-of-bounds memory read, leaking limited browser memory content to a crafted malicious extension. Exploitation requires convincing a user to install the attacker-controlled extension, constraining this to social engineering or supply chain scenarios rather than opportunistic mass exploitation. No public exploit has been identified and EPSS sits at 0.10% (1st percentile), making real-world exploitation probability very low despite Chromium's internal 'High' severity designation.

Technical ContextAI

The vulnerability resides in Chrome's Extensions API - the C++ binding layer that mediates between JavaScript extension code and browser internals. CWE-190 (Integer Overflow or Wraparound) occurs when an arithmetic operation on an integer type produces a value exceeding the type's maximum, wrapping around to a small or negative value. When this corrupted value is subsequently used to index or bound a memory buffer in the Extensions API, the resulting read operation accesses memory beyond the intended allocation boundary. The affected component spans all Chrome desktop versions captured under CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to the 150.0.7871.115 boundary release. The Chromium issue tracker reference (https://issues.chromium.org/issues/515443146) likely contains additional technical detail but may be access-restricted pending broader patch adoption.

RemediationAI

Update Google Chrome to version 150.0.7871.115 or later via Chrome's built-in updater (chrome://settings/help) or via the vendor stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Vendor-released patch: 150.0.7871.115. Prior to patching, enterprise administrators can restrict extension installation to an approved allowlist using Chrome enterprise policy (ExtensionInstallAllowlist / ExtensionInstallForcelist), preventing delivery of the malicious extension that is the prerequisite for exploitation; note this may impact productivity for users relying on unapproved extensions. Enabling Chrome's Enhanced Safe Browsing may flag known-malicious extensions during installation but is not a complete compensating control. Chromium-based browser users should monitor their respective vendors for patched releases tracking this upstream fix.