What is the CVSS score of CVE-2026-15777?

CVE-2026-15777 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-15777?

A critical weakness in Google Chrome for Linux (CVE-2026-15777) could allow attackers to execute unauthorized code on affected systems through malicious websites, but only if users are tricked into…. A patch is available.

How to fix or mitigate CVE-2026-15777?

Within 24 hours, identify all Linux systems running Google Chrome and assess current version levels to determine scope of exposure. Within 7 days, deploy Chrome update 150.0.7871.125 or later across affected systems through your deployment mechanism (enterprise autoupdate, managed endpoints, or user notifications). Within 30 days, verify patch deployment completion across all systems and monitor security logs for any anomalous Chrome process behavior or evidence of exploitation attempts.

Google Chrome CVE-2026-15777

EUVD-2026-44484 HIGH

Use After Free (CWE-416)

2026-07-14 Chrome

GHSA-hgvh-mhw9-c77h

Denial Of Service Google Use After Free Memory Corruption Red Hat

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via web page (AV:N) with no auth (PR:N) but requires specific user gestures (UI:R) and winning a UAF/heap-grooming race (AC:H); UAF can yield full code execution, so C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:38 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jul 14, 2026 - 20:09 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Google Chrome's UI component on Linux (versions prior to 150.0.7871.125) lets a remote attacker trigger heap corruption through a crafted HTML page, but only after luring the victim into performing specific UI gestures. Rated High severity by Chromium and CVSS 7.5, the flaw carries full confidentiality, integrity, and availability impact and could lead to code execution inside the renderer, though no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with the high attack complexity and required user interaction.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's UI layer - a class of memory-safety bug where a heap object is freed while a dangling pointer to it is still used, allowing an attacker who controls subsequent heap allocations to groom memory and corrupt the heap. Because it lives in the browser UI rather than a sandboxed renderer subsystem, a successful trigger manipulates browser-process object lifetimes. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the Linux desktop build; the same Chromium release train also updated ChromeOS per the Chrome Releases advisories. UAF bugs of this type typically yield heap corruption first, which an attacker then shapes toward arbitrary read/write and ultimately code execution.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.125 or later on Linux, as published in the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html); ChromeOS users should take the corresponding stable channel update (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-chromeos_01375142362.html). Because Chrome auto-updates, ensure the update is applied and fully relaunch the browser to load the patched binary, and in managed fleets push the fixed version via policy and confirm rollout. If patching must be delayed, reduce exposure by limiting browsing to trusted sites and coaching users not to perform unusual prompted UI gestures on untrusted pages, since exploitation depends on user interaction; there is no clean feature toggle that disables the vulnerable UI path without breaking normal browsing, so patching is the only reliable fix.