What is the CVSS score of CVE-2026-15773?

CVE-2026-15773 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-15773?

Google Chrome on Windows (versions before 150.0.7871.125) contains a critical sandbox escape vulnerability; no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-15773?

Within 24 hours, conduct an audit of Chrome versions deployed across all Windows endpoints using asset management tools to identify systems running versions prior to 150.0.7871.125. Within 7 days, deploy Chrome 150.0.7871.125 or later to all affected systems either through automatic updates, group policy deployment, or mobile device management; prioritize systems with high-value users or sensitive data access. Within 30 days, verify 100% compliance with the patched version through endpoint monitoring, audit logs, and user-agent analysis.

Google Chrome CVE-2026-15773

EUVD-2026-44480 CRITICAL

Use After Free (CWE-416)

2026-07-14 Chrome

GHSA-ggx2-5pvf-g8xh

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N) requiring victim interaction (UI:R); a reliable UAF sandbox escape needs heap grooming so AC:H, and it crosses the sandbox boundary (S:C).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:01 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 14, 2026 - 20:09 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows (versions prior to 150.0.7871.125) stems from a use-after-free in the browser's Core component, letting a remote attacker who lures a user to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. The flaw is rated High by Chromium and carries a 9.6 CVSS due to scope change and full CIA impact, though it requires user interaction (visiting the page). There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none, with a low EPSS probability of 0.26%.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in Chrome's 'Core' browser-process code, where memory is referenced after it has been freed, allowing an attacker to reclaim and control that memory to influence program flow. Because the affected code sits in the privileged browser process (Core), a successful exploit can escape the renderer sandbox that normally confines web content, unlike a renderer-only UAF. The affected product per CPE is cpe:2.3:a:google:chrome (all versions up to the fix), and the underlying Blink/Chromium engine ships in the desktop Chrome build for Windows; the CVSS scope-changed metric (S:C) reflects that the compromise crosses the sandbox trust boundary from web content into the host process.

RemediationAI

Vendor-released patch: 150.0.7871.125 - update Google Chrome to 150.0.7871.125 or later on Windows via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html); Chrome's built-in auto-update applies this after a browser restart, so ensure users relaunch to complete the update. In managed environments, push the update through your enterprise mechanism (Google Update / admin policy) and verify the deployed version. Until patching completes, reduce exposure by restricting browsing of untrusted sites and cautioning users against opening unsolicited links, and keep site isolation enabled; note these are only partial mitigations because the trigger is a crafted web page and cannot be fully blocked without patching, and overly aggressive URL blocking may disrupt legitimate browsing. Confirm remediation via chrome://settings/help showing 150.0.7871.125 or higher.