What is the CVSS score of CVE-2026-15133?

CVE-2026-15133 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15133?

Google Chrome versions before 150.0.7871.115 contain an unauthenticated remote code execution vulnerability requiring only user interaction, exposing all Chrome users across the organization to…. A patch is available.

How to fix or mitigate CVE-2026-15133?

Within 24 hours: Audit all endpoints and identify systems running Chrome versions before 150.0.7871.115; notify users of mandatory update requirement. Within 7 days: Deploy Chrome 150.0.7871.115 or later via mobile device management or patch management system; prioritize business-critical roles and systems requiring manual deployment. Within 30 days: Confirm 100% patching compliance through inventory/patch management audit reports and take remediation action for any non-compliant systems.

Google Chrome CVE-2026-15133

EUVD-2026-42479 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-mm39-x96q-96j9

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only that the victim navigate to it (AV:N/AC:L/PR:N/UI:R); code runs in the renderer with no scope change (S:U) but high memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:54 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 150.0.7871.115 stems from a use-after-free in the InterestGroups component (the Protected Audience / FLEDGE ad-auction API of Privacy Sandbox), letting a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity High, and the CVSS 8.8 reflects network-reachable, low-complexity, unauthenticated exploitation gated only by user interaction (visiting a page). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though EPSS-style risk for Chrome memory-corruption bugs is typically elevated once details circulate.

Technical ContextAI

The affected component, InterestGroups, is part of Chromium's Protected Audience API (formerly FLEDGE), which stores per-site advertising interest groups in the browser to run on-device ad auctions. CWE-416 (Use After Free) means the code continues to reference heap memory after it has been freed, allowing an attacker who controls object lifetime and reallocation to corrupt memory and hijack control flow. Per the EUVD/NVD CPE scope, this affects Google Chrome builds prior to 150.0.7871.115 across desktop platforms; because Chromium is the upstream engine, downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) may share the vulnerable code until they rebase onto the patched revision.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later on all desktop platforms via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html); relaunch the browser to apply the update since Chrome stages it in the background. For managed fleets, push the update through enterprise policy and force a restart to close the window between download and activation. Users of Chromium-based browsers should apply their vendor's build once it rebases onto the fixed revision. As an interim compensating control where immediate patching is impossible, restrict exposure by disabling the Privacy Sandbox / Protected Audience ad-auction features via enterprise policy (e.g., PrivacySandboxAdMeasurementEnabled / related ad-topics settings), accepting the trade-off that some ad-personalization and measurement functionality will stop working; also enforce cautious browsing and block untrusted sites, since exploitation requires the victim to load a malicious page.