What is the CVSS score of CVE-2026-15114?

CVE-2026-15114 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-15114?

Google Chrome users across the organization face potential device compromise through a heap corruption vulnerability in video codec handling (CVE-2026-15114); attackers require only user…. A patch is available.

How to fix or mitigate CVE-2026-15114?

Within 24 hours: issue an emergency security alert and confirm Chrome deployment channels. Within 7 days: deploy Chrome 150.0.7871.115 or later to all managed endpoints. Within 30 days: verify 100% compliance and conduct user training on avoiding untrusted video links.

Google Chrome CVE-2026-15114

EUVD-2026-42485 HIGH

Out-of-bounds Read (CWE-125)

2026-07-08 chrome-cve-admin@google.com

GHSA-c9x3-cmj9-8pxm

Buffer Overflow Information Disclosure Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered media (AV:N/AC:L/PR:N) but victim must load the crafted video (UI:R); heap corruption yields high C/I/A within the unchanged renderer scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:39 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Codecs component allows a remote attacker to trigger out-of-bounds read and write operations by luring a victim to open or play a crafted video file, affecting all desktop builds prior to 150.0.7871.115. Rated High by Chromium and CVSS 8.8, it requires user interaction (viewing malicious media) but no privileges, and combines information disclosure with potential memory corruption that could lead to code execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's media Codecs pipeline, the component responsible for demuxing and decoding video streams. CWE-125 (Out-of-Bounds Read) - combined here with an out-of-bounds write per the description - indicates the decoder trusts attacker-controlled size or offset fields in a malformed video container/stream and reads or writes past the bounds of a heap buffer. Because media decoding runs on untrusted web-delivered content, a crafted video file can corrupt adjacent heap structures, a classic precursor to controlled heap corruption and potential renderer-process compromise. The Codecs code is shared across the Chromium engine, so Chromium-derived browsers (Edge, Brave, Opera, Electron apps) likely inherit the same defect until they pick up the upstream fix.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later on all desktop platforms via the built-in updater (Settings > About Chrome) followed by a browser relaunch to load the fix, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Users of Chromium-based browsers should install the equivalent vendor build once it incorporates the upstream fix. As an interim compensating control before patching, avoid opening untrusted video files and restrict autoplay/media from untrusted sites; enterprises can enforce update deployment through group policy or MDM and, where feasible, deploy Chrome's site-isolation and enhanced security settings - noting these reduce but do not eliminate exposure to a media-decoder flaw since decoding still occurs for legitimately loaded content.