What is the CVSS score of CVE-2026-15765?

CVE-2026-15765 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google are affected by CVE-2026-15765?

Google Chrome versions prior to 150.0.7871.125 contain a heap corruption vulnerability (CVE-2026-15765) that could allow attackers to compromise user systems through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-15765?

Within 24 hours, inventory Chrome deployment across all endpoints and identify systems running versions prior to 150.0.7871.125. Within 7 days, deploy Chrome 150.0.7871.125 or later to all affected systems via your standard update mechanism (Windows Update, JAMF, or equivalent), prioritizing systems with elevated privileges or web-facing roles. By day 30, confirm 100% remediation through asset management systems and establish automated deployment of future Chrome updates to prevent similar exposure windows.

Google CVE-2026-15765

EUVD-2026-44472 HIGH

Use After Free (CWE-416)

2026-07-14 Chrome

GHSA-xxvr-rjcx-vqw8

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

7.5 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:31 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jul 14, 2026 - 20:09 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Ozone graphics/windowing layer (versions prior to 150.0.7871.125) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free with total technical impact. Chromium rates the underlying bug Critical, though the CVSS is 7.5 because exploitation hinges on user interaction and high attack complexity. There is no public exploit identified at time of analysis, EPSS risk is low (0.30%, 22nd percentile), and CISA SSVC records exploitation status as none.