What is the CVSS score of CVE-2026-15771?

CVE-2026-15771 has a contested CVSS base score of 5.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-15771?

Yes, a patch is available for CVE-2026-15771. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-15771

EUVD-2026-44478 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 Chrome

GHSA-cxg3-wp3j-33gc

Information Disclosure Google Microsoft Red Hat Suse

Medium

Disputed · 5.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AC:H reflects the mandatory renderer pre-compromise prerequisite; C:H captures arbitrary process memory read; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.3 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:03 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

5.3 (MEDIUM)

CVE Published

Jul 14, 2026 - 20:09 cve.org

MEDIUM 5.3

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.

Technical ContextAI

The Media component in Chrome handles audio and video processing pipelines. CWE-20 (Improper Input Validation) indicates the root cause is a failure to sanitize or bounds-check untrusted input flowing through the Media subsystem, leading to a read of uninitialized or out-of-bounds process memory. The vulnerability is scoped exclusively to Chrome on Windows (the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions but the description explicitly constrains the platform to Windows). The CVSS vector's S:U (Scope Unchanged) confirms the impact is confined to the Chrome process itself - memory disclosure does not directly cross sandbox boundaries but could expose credentials, session tokens, or other sensitive data held in the browser process.

RemediationAI

Upgrade Google Chrome on Windows to version 150.0.7871.125 or later, which is the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. Chrome's auto-update mechanism will deploy this in most enterprise environments; verify deployment via fleet management tooling. Because exploitation requires a pre-compromised renderer, mitigating renderer compromise risk (e.g., keeping Chrome fully patched, enabling Chrome's Site Isolation, and restricting navigation to untrusted sites) also reduces exposure. No specific workaround for this exact flaw is available absent the patch. Organizations with extended patching cycles should prioritize Windows Chrome endpoints, as the platform restriction limits exposure compared to a cross-platform flaw.