What is the CVSS score of CVE-2026-15764?

CVE-2026-15764 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-15764?

Google Chrome on Linux contains a remote code execution vulnerability (CVE-2026-15764) that could allow attackers to compromise user browsers through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-15764?

Within 24 hours, assess the scope of Chrome deployments on Linux systems within your environment and communicate patch availability to affected teams. Within 7 days, prioritize deployment of Google Chrome 150.0.7871.125 or later to all Linux systems running earlier versions. Within 30 days, verify patch compliance across all Linux Chrome instances and confirm no earlier versions remain in production or development environments.

Google Chrome CVE-2026-15764

EUVD-2026-44471 HIGH

Use After Free (CWE-416)

2026-07-14 Chrome

GHSA-ffvp-vxw4-jcm4

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page (AV:N, PR:N) but success needs unreliable heap grooming plus attacker-directed user gestures, so AC:H and UI:R; potential in-process code execution gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.5 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:30 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jul 14, 2026 - 20:09 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Ozone component on Linux (versions prior to 150.0.7871.125) allows a remote attacker to potentially execute arbitrary code within the browser process after luring a victim to a crafted HTML page and coaxing them into specific UI gestures. Chromium rated the flaw Critical severity, though its practical exploitability is tempered by the required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none'.

Technical ContextAI

The defect is a use-after-free (CWE-416) in Ozone, the Chromium platform abstraction layer that mediates graphics, windowing, and input on Linux (it replaces the legacy X11-specific path and backs both X11 and Wayland/Ozone-DRM display integration). A use-after-free arises when memory is freed but a dangling pointer continues to be dereferenced; in a browser's rendering/compositing path this typically lets an attacker groom the heap so the freed object is reallocated with attacker-controlled data, converting the dangling reference into control over object state. The single affected CPE is cpe:2.3:a:google:chrome, and because Ozone is Linux-specific, the exposure is limited to Chrome on Linux (with the same underlying Chromium release train also servicing ChromeOS per the referenced advisory).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.125 or later on Linux (and apply the corresponding ChromeOS stable-channel update) as delivered through Google's Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html ; because Chrome auto-updates, ensure the browser is fully relaunched so the new binary is loaded, and in managed fleets push the minimum-version policy or force the update via your enterprise update channel. Until the update is applied, reduce exposure by having users avoid untrusted web pages and refrain from performing unexpected in-page UI gestures prompted by such pages, since exploitation requires user interaction; there is no vendor-documented feature toggle that disables Ozone as a workaround (Ozone is the standard Linux display backend and disabling it is not a supported mitigation), so patching is the reliable control.