What is the CVSS score of CVE-2026-15124?

CVE-2026-15124 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-15124?

Yes, a patch is available for CVE-2026-15124. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-15124

EUVD-2026-42453 MEDIUM

Improper Input Validation (CWE-20)

2026-07-08 chrome-cve-admin@google.com

GHSA-fh7w-cwh7-hvq9

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page requires victim visit (UI:R); no attacker privileges needed; SOP bypass yields limited cross-origin read only (C:L), with no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.1 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:14 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

4.3 (MEDIUM)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's Passwords component (versions prior to 150.0.7871.115) enables a remote attacker to read limited cross-origin data by directing a victim to a crafted HTML page. Chromium's own security team rates this High despite a CVSS base score of 4.3 (Medium), a discrepancy that likely reflects the sensitivity of credential-adjacent subsystem involvement rather than raw exploitability metrics alone. No public exploit identified at time of analysis; vendor patch is available as of the July 2026 stable channel release.

Technical ContextAI

The vulnerability resides in Chrome's built-in Passwords subsystem and is rooted in CWE-20 (Improper Input Validation) - specifically, the browser's failure to enforce same-origin policy (SOP) constraints sufficiently within that component. SOP is the foundational browser security boundary preventing scripts from reading resources belonging to a different origin (scheme + host + port). When the Passwords component processes input from a crafted page without adequate policy checks, a cross-origin read becomes possible. Affected scope covers Google Chrome desktop (Windows, macOS, Linux) for all versions below 150.0.7871.115, per the EUVD-2026-42453 record and the Chrome stable channel advisory. No explicit CPE string was provided in the input data.

RemediationAI

Update Google Chrome to version 150.0.7871.115 or later immediately using Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or enterprise deployment tooling such as Google Admin or third-party patch management. The fix is detailed in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. For environments that cannot patch immediately, enterprise administrators may restrict navigation to allowlisted trusted origins via Chrome's URLAllowlist/URLBlocklist policies, which limits attacker-controlled page delivery - though this constrains general browsing. Temporarily disabling Chrome's built-in password manager (chrome://settings/passwords) and migrating credentials to a standalone password manager removes the vulnerable component from the attack surface, but eliminates autofill convenience and requires user workflow changes. No other workarounds are identified from available data.