What is the CVSS score of CVE-2026-15110?

CVE-2026-15110 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-15110?

Google Chrome versions prior to 150.0.7871.115 contain a heap corruption vulnerability in the Extensions component that could enable arbitrary code execution if a user installs a malicious extension.. A patch is available.

How to fix or mitigate CVE-2026-15110?

Within 24 hours, audit Chrome versions deployed across your environment and identify all systems running versions prior to 150.0.7871.115. Within 7 days, deploy Chrome 150.0.7871.115 or later through your standard patch management process, prioritizing business-critical systems and users with elevated data access. Within 30 days, complete deployment across all endpoints and enforce extension installation policies to restrict deployment to approved extensions only.

Google Chrome CVE-2026-15110

EUVD-2026-42482 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-c48f-7jv4-r33v

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered extension but success hinges on convincing the user to install a malicious extension and heap grooming, so AC:H and UI:R; no privileges needed pre-install (PR:N) with high C/I/A from memory corruption.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:12 vuln.today

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Extensions component (versions prior to 150.0.7871.115) can be triggered by a malicious browser extension exploiting a use-after-free condition, potentially leading to arbitrary code execution within the renderer or browser process. An attacker must first convince the victim to install a crafted Chrome extension, after which the freed-object reuse can be leveraged for exploitation. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.10%, 1st percentile) with CISA SSVC recording no known exploitation.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in the Chromium Extensions subsystem, which manages the lifecycle, APIs, and privileged bindings of installed browser extensions. A use-after-free occurs when the code continues to reference heap memory after it has been freed, allowing an attacker who controls subsequent heap allocations to place a crafted object in the reclaimed slot and corrupt program state. Because extensions run with elevated access to Chrome's extension APIs and interact closely with the browser process, memory corruption in this layer is a classic vector for sandbox-relevant exploitation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop browser across all builds below the fixed release.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later via the Stable channel, then fully relaunch the browser to apply the update, as documented in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html). Because exploitation requires installing a malicious extension, effective compensating controls where immediate patching is not possible include restricting extension installation to an enterprise allowlist via the ExtensionInstallAllowlist/ExtensionInstallBlocklist group policies (trade-off: blocks users from adding unapproved extensions), setting ExtensionInstallForcelist to permit only vetted extensions, and auditing currently installed extensions to remove untrusted or unnecessary ones (trade-off: administrative overhead and potential workflow disruption). Users of Chromium-based browsers should apply their respective vendor updates once rebased on the fixed Chromium version.