What is the CVSS score of CVE-2026-15111?

CVE-2026-15111 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-15111?

Google Chrome versions before 150.0.7871.115 contain a heap corruption vulnerability that allows code execution via malicious web pages; while no public exploit has been identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-15111?

Within 24 hours: Issue mandatory Chrome update notification to all users; confirm automatic updates are enabled and escalate any blocked deployments. Within 7 days: Verify patch deployment across all managed endpoints using EDR or inventory tools; prioritize remediation of systems still running versions prior to 150.0.7871.115. Within 30 days: Establish automated Chrome version compliance tracking to detect future vulnerabilities and enable rapid patch deployment.

Google CVE-2026-15111

EUVD-2026-42483 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-r6fh-64mw-837m

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:34 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework (versions prior to 150.0.7871.115) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page potentially execute code or crash the browser via a use-after-free. Google rates the Chromium severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome UAF bugs are historically attractive exploitation targets.