What is the CVSS score of CVE-2026-15900?

CVE-2026-15900 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15900?

Google Chrome desktop contains a critical remote code execution vulnerability (CVE-2026-15900) that can be triggered by users simply visiting a compromised website, with no authentication required.. A patch is available.

How to fix or mitigate CVE-2026-15900?

Within 24 hours: Inventory all Chrome desktop instances using your endpoint detection and response (EDR) or mobile device management (MDM) platform, and confirm the current version baseline. Within 7 days: Deploy Chrome version 150.0.7871.128 or later through your standard change management and patch distribution process, prioritizing machines accessing sensitive data or supporting critical business functions. By day 30: Validate 100% remediation through automated vulnerability scanning or MDM reporting, update your risk register to reflect resolution, and implement automatic browser update policies to eliminate manual patch delays for future critical releases.

Google Chrome CVE-2026-15900

EUVD-2026-46126 CRITICAL

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-fm68-7vm5-9rgw

Information Disclosure Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via a malicious page, no privileges but required user interaction; AC:H because a use-after-free needs heap grooming/timing, and S:C reflects a likely sandbox-boundary crossing with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

9.6 (CRITICAL)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Remote code execution and information disclosure in Google Chrome desktop before 150.0.7871.128 stems from a use-after-free flaw (CWE-416) that a malicious web page can trigger when a victim simply visits it. The CVSS 3.1 score of 9.6 with a scope change reflects a likely sandbox-boundary crossing, giving an attacker high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.22%, 12th percentile), but browser use-after-free bugs are a historically favored exploitation target.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416), a memory-corruption class where a pointer keeps referencing heap memory after it has been freed, letting an attacker reallocate that region with controlled data and hijack subsequent dereferences. In Chromium/Chrome these bugs typically live in a renderer-process component (V8, Blink DOM, or a graphics/media subsystem) reachable from untrusted web content. The reported scope change (S:C) implies the flaw can affect resources beyond the initially vulnerable component - consistent with a renderer-to-browser sandbox escape. The affected component is tracked in Chromium issue 523750584, and the fix shipped in the Chrome Stable channel build 150.0.7871.128.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.128 or later via the Stable channel; verify through chrome://settings/help, which forces an update check and relaunch. In managed environments push the updated build through your enterprise mechanism (Google Update / Chrome Browser Cloud Management) and confirm end-user relaunch, since Chrome only completes the update after a restart. Refer to the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html. If immediate patching is impossible, reduce exposure by restricting browsing to trusted sites, enforcing strict site-isolation and enhanced-security policies, and disabling untrusted extensions - with the trade-off that these controls hinder normal browsing and do not fully eliminate a drive-by use-after-free triggered by a single malicious page. Chromium-based browser users should apply their vendor's corresponding rebased release.