What is the CVSS score of CVE-2026-15112?

CVE-2026-15112 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15112?

Google Chrome users organization-wide are exposed to a high-severity remote code execution vulnerability (no public exploit identified at time of analysis) that requires no authentication to exploit;…. A patch is available.

How to fix or mitigate CVE-2026-15112?

Within 24 hours: Inventory Chrome deployments across all systems and identify all instances running versions before 150.0.7871.115. Within 7 days: Initiate forced deployment of Chrome 150.0.7871.115 or later organization-wide via MDM, SCCM, or equivalent enterprise patch management tool; prioritize internet-connected endpoints. Within 30 days: Verify 100% deployment compliance, enable automatic Chrome updates, and audit for any remaining vulnerable instances.

Google Chrome CVE-2026-15112

EUVD-2026-42476 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-8cjf-6ccp-mxf7

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); memory corruption yields High C/I/A within a renderer-confined, unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:36 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote heap corruption in Google Chrome desktop before 150.0.7871.115 stems from a use-after-free (CWE-416) in Ozone, the platform abstraction layer that mediates windowing, graphics, and input. A remote attacker who lures a victim into loading a crafted HTML page can trigger the freed-memory reuse and potentially achieve renderer-level code execution; Chromium rates the underlying flaw Critical. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege, low-complexity CVSS 8.8 profile makes it a high-priority browser patch.

Technical ContextAI

Ozone is Chromium's abstraction layer that decouples the browser from the underlying native windowing/graphics stack (X11, Wayland, DRM/GBM, headless), handling surface creation, display configuration, and input event routing. A use-after-free (CWE-416) here means an object is freed while a dangling pointer to it is later dereferenced, letting an attacker reshape the freed heap slot and corrupt the heap. Because Ozone processes page-driven rendering and display state, a crafted HTML page can drive the allocation/free lifecycle to reach the vulnerable code path. Controlling the reclaimed freed memory is the classic primitive that leads from heap corruption toward arbitrary read/write and code execution within the affected process.

RemediationAI

Vendor-released patch: 150.0.7871.115 - update Google Chrome desktop to 150.0.7871.115 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html) and relaunch the browser, since Chrome only applies staged updates on restart. In managed fleets, push the update through enterprise Chrome auto-update policies or MSI/pkg redeployment and verify the reported version. Because the only exploitation gate is opening a malicious page, interim compensating controls include enforcing rapid auto-update, restricting browsing to trusted sites via web/URL filtering, and ensuring the Chrome sandbox is not disabled (avoid the --no-sandbox flag); note that URL filtering does not stop malvertising or exploitation via compromised legitimate sites and so is not a substitute for patching. Users of other Chromium-based browsers should apply the corresponding vendor build once it incorporates the fixed engine version.