What is the CVSS score of CVE-2026-15901?

CVE-2026-15901 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15901?

A critical use-after-free vulnerability in Google Chrome prior to version 150.0.7871.128 enables remote code execution when users visit malicious webpages, posing direct risk to employee devices and…. A patch is available.

How to fix or mitigate CVE-2026-15901?

Within 24 hours, distribute a critical security alert to all Chrome users with specific guidance to install version 150.0.7871.128 immediately, and remove or block older versions from execution where technically feasible. Within 7 days, deploy Chrome 150.0.7871.128 organization-wide using your endpoint management platform (Intune, Jamf, or equivalent), prioritizing high-risk user populations and external-facing systems. Within 30 days, audit patch deployment rates to confirm 95%+ compliance, review security logs for exploitation attempts during the exposure window, and validate that automatic Chrome updates remain enabled across all systems.

Google Chrome CVE-2026-15901

EUVD-2026-46127 CRITICAL

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-x5x7-mh5c-626x

Information Disclosure Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered browser UAF triggered by visiting a page (AV:N/AC:L/PR:N/UI:R); renderer-boundary crossing gives S:C with high C/I/A memory-corruption impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

9.6 (CRITICAL)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

CVE Published

Jul 20, 2026 - 00:00 cve.org

MEDIUM

DescriptionCVE.org

[Unknown description]

AnalysisAI

Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).

Technical ContextAI

This is a CWE-416 use-after-free defect in Google Chrome, the Chromium-based desktop browser. Use-after-free bugs occur when a pointer to freed heap memory is subsequently dereferenced, letting an attacker groom the heap to place attacker-controlled data at the reclaimed allocation and influence program flow. In a browser context these flaws are typically triggered by JavaScript/DOM interactions or rendering operations within the sandboxed renderer process, and the tags 'Information Disclosure' and 'Memory Corruption' indicate both read (leak) and write (corruption) primitives may be reachable. The affected build string (Chrome 150.0.7871.128) and Chromium issue tracker reference (issues.chromium.org/issues/533446300) tie this to a specific component fixed in the Stable channel; the exact module is not disclosed in the provided data.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.128 or later via the Stable channel, following the Chrome Releases advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html. Trigger Chrome's built-in updater (chrome://settings/help) and relaunch to apply, and ensure managed fleets receive the update via enterprise policy or MDM. As interim compensating controls before patching, restrict browsing to trusted sites, enable site isolation (default on in modern Chrome) to contain renderer compromise, and consider deploying URL filtering to block untrusted/unknown domains - the trade-off being reduced usability and reliance on the completeness of the block list. Since exploitation requires loading attacker content, user awareness against unsolicited links also reduces exposure.