What is the CVSS score of CVE-2026-15767?

CVE-2026-15767 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-15767?

Google Chrome for Windows users running versions prior to 150.0.7871.125 are exposed to a remote code execution vulnerability (CVE-2026-15767) that could enable attackers to install malware, steal…. A patch is available.

How to fix or mitigate CVE-2026-15767?

Within 24 hours, inventory all Chrome installations across Windows systems to identify devices running versions prior to 150.0.7871.125. Within 7 days, deploy patched Chrome version 150.0.7871.125 or later to all affected Windows systems through your endpoint management platform. Within 30 days, verify successful deployment across all Windows systems and monitor endpoint logs for any exploitation attempts related to CVE-2026-15767.

Google Chrome CVE-2026-15767

EUVD-2026-44474 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 Chrome

GHSA-9h5f-7xg6-rp7h

RCE Buffer Overflow Google Heap Overflow Microsoft Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-video trigger needs no privileges (PR:N) but requires the user to load content (UI:R); high C/I/A reflect renderer code execution, scope unchanged as impact stays in the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:04 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

Jul 14, 2026 - 20:09 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)

AnalysisAI

Renderer-side arbitrary code execution in Google Chrome for Windows (versions prior to 150.0.7871.125) stems from a heap buffer overflow in the bundled libyuv video color-conversion library, letting a remote attacker who lures a victim into loading a crafted video file run code within the renderer sandbox. Chromium rates the severity High; the flaw was reported internally by the Chrome team and a fixed stable build is available. There is no public exploit identified at time of analysis, and EPSS is low (0.33%, 25th percentile), consistent with SSVC exploitation status 'none'.

Technical ContextAI

libyuv is Google's open-source library for YUV/RGB image and video frame conversion and scaling, embedded across Chromium for decoding and rendering video (including WebRTC and <video> playback). The root cause is CWE-122, a heap-based buffer overflow: malformed dimensions or frame metadata in a crafted video cause libyuv to write past an allocated heap buffer during conversion, corrupting adjacent heap memory and enabling control-flow hijacking. Per the CPE (cpe:2.3:a:google:chrome:*), the affected component ships inside the Chrome browser process rather than as a standalone dependency, and the description explicitly scopes code execution to inside the renderer sandbox, meaning a further sandbox-escape chain would be needed for full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.125 or later on Windows via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html); trigger the built-in updater (Help > About Google Chrome) and relaunch to apply. Because Chrome auto-updates, most managed fleets will remediate automatically, but enterprises pinning versions or using extended-stable channels should force the rollout and verify the running build. There is no configuration workaround inside Chrome for the vulnerable libyuv code path; as interim compensating controls before patching, restrict or warn against opening untrusted video content and links, and enforce update policies via Group Policy so users cannot defer relaunch. Avoid disabling the renderer sandbox as a mitigation - it is a key barrier that keeps this bug confined to the sandbox, and disabling it would worsen exposure.