What is the CVSS score of CVE-2026-15129?

CVE-2026-15129 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15129?

Google Chrome users in your organization are at risk from a critical vulnerability (CVE-2026-15129) that can lead to complete system compromise if users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-15129?

Within 24 hours: Issue security alert to all users and IT teams; verify current Chrome version distribution across managed endpoints. Within 7 days: Deploy vendor-released patch version 150.0.7871.115 or later to all managed Windows, macOS, and Linux systems using WSUS, MDM, or auto-update mechanisms; validate deployment through telemetry. Within 30 days: Achieve 100% compliance; audit unmanaged and BYOD devices; conduct security awareness training on risks of visiting untrusted websites.

Google Chrome CVE-2026-15129

EUVD-2026-42477 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-qcvm-7wgf-4c6m

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery gives AV:N/AC:L/PR:N, the victim must open the page (UI:R), and browser-process memory corruption enables full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:53 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework (versions prior to 150.0.7871.115) lets a remote attacker exploit a use-after-free by luring a victim to a crafted HTML page. The flaw, rated Critical by Chromium and CVSS 8.8, requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Google has shipped a stable-channel fix.

Technical ContextAI

The bug is a CWE-416 use-after-free in Views, Chromium's cross-platform C++ UI toolkit that renders browser chrome and window widgets. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, letting an attacker groom the heap so the reused allocation contains attacker-controlled data, producing heap corruption that can be steered toward control-flow hijack. Because Views runs in the privileged browser process rather than a sandboxed renderer, a reliable exploit here is particularly valuable, though the initial trigger is delivered via web content (a crafted HTML page). The affected CPE-equivalent scope is Google Chrome desktop builds below 150.0.7871.115.

RemediationAI

Vendor-released patch: 150.0.7871.115. Update Google Chrome to 150.0.7871.115 or later on every desktop platform and restart the browser to load the new binary; in managed fleets, force the update via enterprise policy and verify the running version rather than trusting background auto-update. See the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html and the Chromium issue https://issues.chromium.org/issues/524045160. Until the update is deployed, reduce exposure by discouraging browsing of untrusted sites and by keeping site isolation and the sandbox enabled (both on by default); note these mitigations lower but do not eliminate risk since the flaw is in the browser-process Views code, so patching is the only complete fix.