What is the CVSS score of CVE-2026-15118?

CVE-2026-15118 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15118?

Google Chrome contains a remote code execution vulnerability (CVE-2026-15118) in versions before 150.0.7871.115, allowing attackers to compromise user systems through malicious web pages without…. A patch is available.

How to fix or mitigate CVE-2026-15118?

24 hours: Notify all users to update Chrome immediately. 7 days: Deploy Chrome 150.0.7871.115 or later via MDM/group policy; block older versions if enterprise deployment controls are available. 30 days: Audit Chrome version compliance across all endpoints; verify no systems remain on versions before 150.0.7871.115.

Google Chrome CVE-2026-15118

EUVD-2026-42489 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-jhrp-v2xg-mr29

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page requires a user to visit (UI:R) but no auth (PR:N); renderer UAF yields high CIA within an unchanged scope (S:U) as code stays in the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:43 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 150.0.7871.115 stems from a use-after-free in the browser's Input component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code inside the renderer sandbox. Google rates the Chromium severity High and CVSS is 8.8, requiring user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the memory-corruption class and network attack vector make it a standard high-priority browser patch.

Technical ContextAI

The flaw is a CWE-416 use-after-free within Chrome's Input subsystem, the component that dispatches and processes user input events (keyboard, mouse, pointer, touch) in the Blink/renderer pipeline. Use-after-free occurs when code continues to reference memory after it has been freed, allowing an attacker who controls heap layout to place attacker-influenced data where a freed object was, then trigger a dangling reference to corrupt memory and hijack control flow. Because the exploitation surface is reached through page-driven input event handling, a crafted HTML/JavaScript page can drive the allocation and free sequence. Per Google's own wording, arbitrary code execution here is achieved 'inside a sandbox,' meaning the renderer process sandbox still constrains the attacker absent a separate sandbox-escape bug.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later on Windows, macOS, and Linux via the built-in updater (Settings > About Google Chrome) and relaunch the browser to apply, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html). Managed fleets should push the update through enterprise policy/patch management and force a browser restart, since Chrome updates only take effect after relaunch. Users of other Chromium-based browsers should update to the release that incorporates the equivalent fix. As an interim compensating control before patching, reduce exposure by restricting browsing to trusted sites, deploying URL/ad filtering to cut malvertising exposure, and enabling site isolation (default on) to keep the renderer sandbox boundary intact - noting these reduce but do not eliminate risk from a crafted page, and are no substitute for the update.