What is the CVSS score of CVE-2026-15111?

CVE-2026-15111 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-15111?

Google Chrome versions before 150.0.7871.115 contain a heap corruption vulnerability that allows code execution via malicious web pages; while no public exploit has been identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-15111?

Within 24 hours: Issue mandatory Chrome update notification to all users; confirm automatic updates are enabled and escalate any blocked deployments. Within 7 days: Verify patch deployment across all managed endpoints using EDR or inventory tools; prioritize remediation of systems still running versions prior to 150.0.7871.115. Within 30 days: Establish automated Chrome version compliance tracking to detect future vulnerabilities and enable rapid patch deployment.

Google CVE-2026-15111

EUVD-2026-42483 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-r6fh-64mw-837m

Memory Corruption Denial Of Service Use After Free Google

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (google) · only source for this CVE.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:34 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework (versions prior to 150.0.7871.115) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page potentially execute code or crash the browser via a use-after-free. Google rates the Chromium severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome UAF bugs are historically attractive exploitation targets.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Issue mandatory Chrome update notification to all users; confirm automatic updates are enabled and escalate any blocked deployments. …

Threat intelligence, references, and detailed analysis are available after sign-in.