What is the CVSS score of CVE-2026-15121?

CVE-2026-15121 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15121?

Chrome browser vulnerabilities directly threaten employee workstations; unpatched versions below 150.0.7871.115 allow attackers to execute code within the browser sandbox by tricking users into…. A patch is available.

How to fix or mitigate CVE-2026-15121?

Within 24 hours, issue a mandatory security update directive to all Chrome users requiring installation of Google Chrome version 150.0.7871.115 or later, and configure auto-updates to enforce this minimum version. Within 7 days, verify that at least 95% of Chrome installations across managed endpoints have been updated to the patched version using endpoint management tools to confirm compliance. Within 30 days, conduct a full compliance audit to ensure 100% of Chrome desktop builds are at or above version 150.0.7871.115 and document the complete remediation timeline.

Google Chrome CVE-2026-15121

EUVD-2026-42450 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-cjxc-66v9-wp94

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only user navigation (UI:R, PR:N, AC:L); memory-corruption RCE gives high C/I/A but stays within the renderer sandbox, so S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:12 vuln.today

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome's WebRTC component affects all Chrome desktop builds prior to 150.0.7871.115, where a use-after-free (CWE-416) lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Google rates the Chromium severity High and has shipped a fix in the stable channel; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile). Exploitation requires user interaction (visiting a malicious page) and, because code execution is contained to the sandbox, a second sandbox-escape bug would be needed for full host compromise.

Technical ContextAI

The flaw lives in WebRTC, the real-time audio/video/data-channel stack built into Chromium that processes untrusted media and signaling data directly from remote peers and web pages. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference to it remains, and subsequent access to that reference lets an attacker control freed heap memory to corrupt object state and ultimately hijack control flow. Because WebRTC parses complex, attacker-influenced session/media data in the renderer process, it is a recurring memory-corruption attack surface. The single affected CPE, cpe:2.3:a:google:chrome:*, reflects that this is a Chromium-engine bug, so Chromium-derived browsers (Edge, Brave, Opera, Electron apps) are likely affected until they pick up the upstream fix.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later via the Stable Channel; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply it, and force the update in managed fleets through your update policy or MDM. Verify the running version under chrome://settings/help and confirm it is at or above 150.0.7871.115. Users of Chromium-based browsers should apply their vendor's corresponding update once released. If patching cannot be completed immediately, reduce exposure by restricting or disabling WebRTC where it is not needed (for example via enterprise policy or an extension that blocks WebRTC), accepting that this breaks video/voice calling and peer-to-peer features, and by limiting browsing to trusted sites; these are stopgaps, not substitutes for the update. Refer to Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html.