What is the CVSS score of CVE-2026-15132?

CVE-2026-15132 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15132?

Google Chrome versions prior to 150.0.7871.115 contain a remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute code within the browser sandbox when users…. A patch is available.

How to fix or mitigate CVE-2026-15132?

Within 24 hours, deploy Chrome 150.0.7871.115 or later organization-wide through your standard patch management system and notify all users of the mandatory security update. By day 7, verify deployment coverage reaches at least 90% using endpoint telemetry and send reminder notifications to users on older versions. By day 30, confirm 100% compliance, document remediation in your patch management system, and review any approved exceptions.

Google Chrome CVE-2026-15132

EUVD-2026-42478 HIGH

Use of Uninitialized Variable (CWE-457)

2026-07-08 chrome-cve-admin@google.com

GHSA-9mqj-g68q-h5rw

RCE Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges (PR:N) but requires the user to visit it (UI:R); code runs inside the sandbox so Scope is Unchanged with full renderer C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:11 vuln.today

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.115) lets a remote, unauthenticated attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw stems from use of uninitialized memory (CWE-457). No public exploit is identified at time of analysis, CISA SSVC records exploitation status as none, and EPSS is low at 0.24%.

Technical ContextAI

The vulnerability lives in V8, the C++ JavaScript/WebAssembly engine that powers Chrome and all Chromium-derived browsers. CWE-457 (Use of Uninitialized Variable) means a code path reads memory before it has been assigned a defined value; in a JIT-compiling engine like V8 this typically lets an attacker influence type assumptions or object contents, corrupting the heap and steering execution. The single affected CPE, cpe:2.3:a:google:chrome, confirms desktop Chrome as the affected product, and Google's note that code executes 'inside a sandbox' indicates the primitive is contained to the renderer process rather than being a demonstrated sandbox escape.

RemediationAI

Vendor-released patch: 150.0.7871.115 - update Google Chrome to 150.0.7871.115 or later via Help > About Google Chrome (which triggers the auto-update) and relaunch to load the fixed V8 build, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Enterprises managing Chrome by policy should confirm auto-update is enabled and pin the fixed version through their management console; users of other Chromium-based browsers should apply their vendor's corresponding update once shipped. As an interim compensating control before patching, restrict browsing to trusted sites and keep site isolation enabled (default on) so renderer compromise stays contained; disabling V8 JIT via '--js-flags=--jitless' or the JavaScriptJitAllowedForSites policy substantially cuts exploitability of V8 memory bugs but breaks JavaScript-heavy web apps and degrades performance, so use it only as a temporary measure.