What is the CVSS score of CVE-2026-15775?

CVE-2026-15775 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-15775?

Yes, a patch is available for CVE-2026-15775. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-15775

EUVD-2026-44482 MEDIUM

Origin Validation Error (CWE-346)

2026-07-14 Chrome

GHSA-qpx7-r6j6-cqf3

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

9.3 CRITICAL

SOP bypass crosses origin security scopes (S:C); both C:H and I:H apply as cross-origin data can be read and written via the bypassed policy.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.3 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 18:31 vuln.today

CVSS changed

Jul 15, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 20:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 20:09 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same Origin Policy bypass in Google Chrome's V8 JavaScript engine (prior to 150.0.7871.125) allows a remote attacker to cross origin security boundaries via a crafted HTML page, enabling high-impact integrity violations against cross-origin content. Exploitation requires the victim to visit the malicious page (UI:R), limiting automated mass exploitation - a constraint confirmed by SSVC's Automatable:no finding. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; EPSS at 0.26% (17th percentile) is consistent with no observed active exploitation at time of analysis.

Technical ContextAI

V8 is Google Chrome's open-source, high-performance JavaScript and WebAssembly engine. The vulnerability is classified under CWE-346 (Origin Validation Error), indicating a logic flaw in how V8 validates or enforces same-origin constraints rather than a memory-safety issue. The Same Origin Policy is the browser's foundational security boundary preventing scripts from one origin (scheme + host + port) from accessing resources belonging to a different origin. An 'inappropriate implementation' in V8 suggests a code path where origin checks are incomplete, incorrect, or can be bypassed via specific JavaScript constructs or HTML interactions. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome platform variants, and EUVD data confirms the vulnerable range is any Chrome version below 150.0.7871.125.

RemediationAI

Update Google Chrome to version 150.0.7871.125 or later; this is the vendor-released patch as documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. Chrome's built-in auto-update mechanism delivers this release automatically, but enterprise fleet administrators should verify deployment via endpoint management tooling (e.g., Google Admin console, Intune, or equivalent). If immediate patching cannot be completed, consider restricting navigation to untrusted external sites through enterprise browser policies (Chrome's URL blocklist or Safe Browsing enforcement), or configure Site Isolation (--site-per-process) if not already enabled by default - this limits cross-origin data access even if a SOP check is bypassed in V8. Disabling JavaScript globally as a workaround is impractical in most environments due to broad application breakage and is not recommended as a sustained control.