What is the CVSS score of CVE-2026-15120?

CVE-2026-15120 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15120?

Google Chrome on Windows contains a critical sandbox bypass (CVE-2026-15120, CVSS 8.3) in versions prior to 150.0.7871.115 that escalates renderer-level compromise to full browser access, expanding…. A patch is available.

How to fix or mitigate CVE-2026-15120?

Within 24 hours: Identify Chrome version distribution across Windows fleet and notify stakeholders of patch urgency. Within 7 days: Deploy Chrome update to version 150.0.7871.115 or later via WSUS, MDM, or equivalent update channels; prioritize systems handling sensitive workloads. Within 30 days: Verify patch deployment compliance, audit telemetry for successful updates, and monitor for exploitation attempts or suspicious renderer process behavior.

Google Chrome CVE-2026-15120

EUVD-2026-42449 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-m4r4-q82r-9vfm

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the need for a crafted page plus a pre-compromised renderer; S:C captures the renderer-to-browser sandbox escape with full CIA impact, matching the vendor rating.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:46 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Core component on Windows (versions prior to 150.0.7871.115) lets an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 8.3, with a scope change reflecting the renderer-to-browser boundary crossing. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but as the second stage of a browser exploit chain it is a meaningful patch priority.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's 'Core' subsystem, part of the Chromium engine that underpins Chrome and other Chromium-based browsers. Use-after-free occurs when a pointer to heap memory continues to be used after the underlying object has been freed, allowing an attacker to reclaim that memory with attacker-controlled data and manipulate object state or control flow. Because Chrome runs untrusted web content inside a low-privilege sandboxed renderer, this bug matters specifically at the renderer/browser trust boundary: a renderer that is already compromised (typically via a separate renderer RCE bug) can leverage this UAF in the more privileged Core code to escape the sandbox. The affected platform is Windows; the fix landed in 150.0.7871.115 via the Chrome Stable channel.

RemediationAI

Vendor-released patch: 150.0.7871.115 - update Google Chrome on Windows to 150.0.7871.115 or later via the Chrome Stable channel and relaunch the browser to apply the fix, as described in the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. In managed environments, push the update through your enterprise deployment tooling (Google Update/Chrome Enterprise policies) and force a browser restart to ensure the patched binary is loaded. If immediate patching is not possible, reduce exposure by restricting browsing of untrusted sites, since the escape requires rendering attacker-controlled HTML; enabling stricter site isolation and keeping the renderer sandbox intact limits the first-stage foothold this bug depends on. Note that browser-hardening controls only raise the bar and are not a substitute for the version upgrade.