What is the CVSS score of CVE-2026-15902?

CVE-2026-15902 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-15902?

Google Chrome versions prior to 150.0.7871.128 contain a critical heap memory corruption vulnerability (CVE-2026-15902) that could allow remote attackers to execute arbitrary code when users visit…. A patch is available.

How to fix or mitigate CVE-2026-15902?

Within 24 hours, communicate a browser update advisory to all users and identify Chrome deployment channels across the organization. Within 7 days, deploy Chrome version 150.0.7871.128 or later to all organizational systems through your managed browser update mechanisms-prioritize systems handling sensitive data or used by high-value targets. Within 30 days, verify update compliance across 100% of Chrome installations and implement monitoring for any exploit-related security incidents correlated with this CVE.

Google Chrome CVE-2026-15902

EUVD-2026-46128 HIGH

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-m32c-p2c6-5wh9

Information Disclosure Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable via malicious page (AV:N/AC:L/PR:N) but needs user to visit (UI:R); renderer UAF can escape sandbox (S:C) with full memory-corruption impact, matching the vendor rating.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 13:22 NVD

CRITICAL HIGH

CVSS changed

Jul 24, 2026 - 13:22 NVD

9.6 (CRITICAL) 8.8 (HIGH)

Analysis Updated

Jul 22, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

9.6 (CRITICAL)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Use-after-free memory corruption in Google Chrome prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw carries a CVSS 9.6 with a scope change, reflecting the risk of escaping the renderer sandbox, though exploitation requires user interaction. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%, 19th percentile), consistent with a freshly patched browser bug that has not yet been weaponized.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416), a class of temporal memory-safety bug in which a pointer continues to reference heap memory that has already been freed; a subsequent access reads or writes reclaimed memory, enabling information disclosure and, when an attacker can groom the heap, controlled memory corruption. It resides in Chrome's C++ codebase (per the Chromium issue tracker entry issues.chromium.org/issues/522436154) and, like most Chrome UAF findings, is reachable from untrusted web content processed by the renderer. Because Chromium powers many derivative browsers and embedded WebViews, the same engine defect can propagate beyond Chrome itself, though only Chrome is named in this dataset.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.128 or later via the Stable channel; on managed fleets, force the browser relaunch so the updated binary is loaded, since Chrome applies updates on restart. Consult the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html) and the Chromium tracker entry (https://issues.chromium.org/issues/522436154) for details. Linux users on distribution-packaged Chromium should apply the corresponding Ubuntu/distro security update once published (this CVE was reported via vendor:ubuntu). If immediate patching is not possible, compensating controls include restricting browsing to trusted sites via enterprise URL allowlisting and enabling Chrome's site isolation and sandbox (default-on) - these reduce but do not eliminate exposure, at the cost of breaking access to blocked internal or third-party web apps; disabling untrusted browser extensions and JavaScript on high-risk endpoints further narrows the attack surface but degrades usability of modern web applications.