What is the CVSS score of CVE-2026-15899?

CVE-2026-15899 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15899?

A critical use-after-free vulnerability in Google Chrome desktop (CVE-2026-15899, CVSS 9.6) enables remote code execution when users visit attacker-controlled websites.. A patch is available.

How to fix or mitigate CVE-2026-15899?

Within 24 hours: Inventory all Chrome desktop installations across endpoints and identify deployment method (auto-update, managed deployment, or manual). Within 7 days: Deploy Chrome version 150.0.7871.128 or later to all endpoints via your standard browser update mechanism; if auto-update is enabled, verify deployment completion on a sample of systems. Within 30 days: Generate patch compliance report confirming 100% of Chrome desktop instances are at version 150.0.7871.128 or later; document any exceptions and remediation timelines.

Google Chrome CVE-2026-15899

EUVD-2026-46125 CRITICAL

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-w672-5q29-2fg6

Information Disclosure Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Renderer-reachable UAF via malicious web content: network vector, low complexity, no auth, but required user interaction; scope change reflects the browser sandbox boundary with high CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

9.6 (CRITICAL)

Analysis Generated

Jul 20, 2026 - 14:33 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially achieve code execution or information disclosure after a victim visits an attacker-controlled page. The flaw carries a CVSS 9.6 with a scope change reflecting the browser sandbox boundary, but currently shows no public exploit and a low EPSS probability (0.22%, 12th percentile). It is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416), a memory-safety defect in which a pointer to heap memory continues to be used after that memory is freed, allowing an attacker who controls subsequent heap allocations to influence the reused object and hijack control flow or leak memory contents. It affects Chromium/Google Chrome, the widely deployed Blink-based desktop browser; the tags (Information Disclosure, Use After Free, Memory Corruption) and the Chromium issue tracker entry (issues.chromium.org/issues/516987782) indicate a memory-corruption primitive reachable through renderer-processed web content. The EUVD CPE data pins the affected build to Chrome desktop releases prior to 150.0.7871.128.

RemediationAI

Vendor-released patch: 150.0.7871.128 - upgrade Google Chrome desktop to 150.0.7871.128 or later via the Chrome Releases stable-channel update (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html), then fully restart the browser to load the patched binary, since Chrome auto-update stages a new version but does not apply it until relaunch. Verify deployment across managed fleets and confirm Chromium-based browsers pull the corresponding upstream fix. If patching must be delayed, reduce exposure by restricting users from browsing untrusted sites, enforcing enterprise policies that limit rendering of unknown content, and relying on Chrome's site isolation and sandbox hardening - noting these controls reduce but do not eliminate risk for a renderer-reachable use-after-free, and aggressive content restrictions can break legitimate web applications.