What is the CVSS score of CVE-2026-15125?

CVE-2026-15125 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15125?

Google Chrome versions before 150.0.7871.115 contain a remote code execution vulnerability in the renderer sandbox that allows attackers to execute arbitrary code when users visit a malicious…. A patch is available.

How to fix or mitigate CVE-2026-15125?

Within 24 hours: Deploy Chrome 150.0.7871.115 or later through your patch management system; identify and flag devices with auto-updates disabled for manual intervention. Within 7 days: Achieve 100% upgrade compliance on all managed Chrome instances; send notification to users of unmanaged devices to upgrade if accessing corporate systems. Within 30 days: Verify complete remediation; review browser process logs for suspicious activity that may have occurred while vulnerable versions were deployed.

Google Chrome CVE-2026-15125

EUVD-2026-42454 HIGH

Incorrect Authorization (CWE-863)

2026-07-08 chrome-cve-admin@google.com

GHSA-r2p6-2gj6-77xg

Authentication Bypass RCE Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page needs no privileges (PR:N) but requires the user to open it (UI:R); renderer-confined RCE keeps scope unchanged (S:U) with high C/I/A within the process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:50 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome desktop before 150.0.7871.115 lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page, stemming from an inappropriate implementation in the Forms component (Chromium severity: High). No public exploit identified at time of analysis, and the flaw is not on CISA KEV; Google has shipped a fixed Stable channel build. The high CVSS (8.8) reflects full compromise of the affected renderer process, though code execution is stated to be confined to the sandbox rather than a full host takeover.

Technical ContextAI

The affected technology is the Chromium rendering engine's Forms handling code inside Google Chrome, the browser built on the open-source Chromium/Blink platform. Google classifies the root cause as 'Inappropriate implementation in Forms,' and the assigned CWE-863 (Incorrect Authorization) points to a logic/authorization flaw in how form-related functionality enforces its security boundaries, rather than a classic memory-corruption bug. Because the code executes inside Chrome's multi-process sandbox, a successful exploit gains control of the constrained renderer process; a separate sandbox-escape bug would be required to reach the host OS, which the advisory does not describe. No CPE strings were provided in the input, but the EUVD entry constrains the affected product to Chrome builds prior to 150.0.7871.115.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later on every desktop platform via the built-in updater (Settings > About Google Chrome) and relaunch the browser to apply it, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Enterprises should push the updated build through their managed-update tooling (Google Update/ADMX policies) and confirm the version string across the fleet. As an interim compensating control until updates propagate, restrict or discourage browsing to untrusted sites and consider enabling Chrome's site-isolation and enterprise policies that limit exposure to attacker-controlled pages; note these controls reduce but do not eliminate exposure and can affect legitimate site functionality. Because the bug requires opening a crafted page, user-awareness against untrusted links is a meaningful stopgap but not a substitute for the patch.