What is the CVSS score of CVE-2026-15122?

CVE-2026-15122 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15122?

Google Chrome on Windows contains a sandbox escape vulnerability (CVSS 8.3) that allows attackers who have compromised the browser process to escalate privileges and take control of the underlying…. A patch is available.

How to fix or mitigate CVE-2026-15122?

Within 24 hours: Inventory all Windows systems running Chrome versions prior to 150.0.7871.115 and communicate mandatory patch requirement to users. Within 7 days: Deploy Google Chrome version 150.0.7871.115 or later through your patch management system to all affected Windows endpoints. Within 30 days: Verify 100% deployment completion and confirm no legacy versions remain in production.

Google Chrome CVE-2026-15122

EUVD-2026-42451 HIGH

Improper Input Validation (CWE-20)

2026-07-08 chrome-cve-admin@google.com

GHSA-mgx7-w737-hvvj

Information Disclosure Google Microsoft Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page (AV:N/UI:R) but requires a prior renderer compromise making it high-complexity (AC:H); the sandbox-boundary crossing is S:C with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:47 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.3 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 150.0.7871.115 allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page, chaining a codec input-validation flaw into higher-privileged host-process compromise. The bug is rated High by Chromium and carries a CVSS 8.3 with a scope-changing vector reflecting the sandbox-boundary crossing. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Chrome's media Codecs subsystem, which parses and decodes audio/video streams delivered through web content. Per CWE-20 (Improper Input Validation), the codec code fails to sufficiently validate untrusted input before processing it, allowing malformed media data to drive the decoder into an unsafe state. Because media decoding in Chrome runs partly in privileged host-side services rather than fully inside the locked-down renderer, a renderer that feeds crafted input across the IPC boundary can influence a more-privileged process - which is why this manifests as a sandbox escape (CVSS scope change S:C) rather than a mere renderer crash. Affected CPE per the EUVD/NVD data is Google Chrome on Windows builds below 150.0.7871.115.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.115 for Windows - upgrade to this build or later via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, which is the primary and complete fix. In managed environments, push the update through your enterprise update policy and verify clients have relaunched, since the fix is inert until restart. Reference the Google Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html and the NVD detail at https://nvd.nist.gov/vuln/detail/CVE-2026-15122. As an interim compensating control before patching, reduce renderer-compromise exposure by keeping Chrome's site isolation enabled (default) and restricting untrusted media playback where feasible; note that disabling media codecs is impractical and degrades normal browsing, so rapid patching is strongly preferred over workarounds.