What is the CVSS score of CVE-2026-15904?

CVE-2026-15904 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-15904?

Google Chrome prior to version 150.0.7871.128 contains a use-after-free memory vulnerability (CVE-2026-15904, CVSS 8.8) that could allow remote attackers to steal sensitive data or execute code…. A patch is available.

How to fix or mitigate CVE-2026-15904?

Within 24 hours, verify Chrome deployment version across all endpoints and identify machines running versions prior to 150.0.7871.128. Within 7 days, deploy Chrome 150.0.7871.128 or later to all affected endpoints; prioritize business-critical systems and those with high internet exposure. By day 30, confirm 100% of Chrome installations have been updated by running an inventory report and document the deployment timeline for compliance purposes.

Google Chrome CVE-2026-15904

EUVD-2026-46130 HIGH

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-7hhh-6c82-7vf3

Information Disclosure Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote malicious web content with no auth (AV:N/PR:N) but requiring a page visit (UI:R); a renderer UAF yields high C/I/A with scope unchanged absent a sandbox escape.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

8.8 (HIGH)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Use-after-free memory corruption in Google Chrome versions prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially disclose sensitive information or execute code after a user visits a malicious web page. The flaw was reported through the Ubuntu vendor channel and fixed in Chrome's Stable desktop channel; no public exploit identified at time of analysis, and its EPSS exploitation probability is low (0.22%). Successful exploitation requires user interaction (visiting attacker-controlled content) but no authentication.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416), a temporal memory-safety defect in which a pointer continues to reference heap memory after it has been freed, allowing an attacker who controls subsequent allocations to place attacker-influenced data at the dangling location. In a browser such as Chrome, these bugs typically arise in a rendering, DOM, media, or IPC component processing untrusted web content, where object lifetime is mismanaged across asynchronous callbacks or event handlers. The affected component is tracked internally at Chromium issue 532925350; the tags Information Disclosure and Memory Corruption indicate the primitive can leak process memory and/or corrupt heap metadata, which is the classic precursor to renderer compromise. The affected build is identified by the EUVD data as Chrome versions below 150.0.7871.128.

RemediationAI

Vendor-released patch: update Google Chrome to version 150.0.7871.128 or later via the Stable desktop channel; use Help > About Google Chrome to trigger the automatic update and then relaunch the browser to apply it, as documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html. Enterprises managing Chrome through group policy or MDM should push the fixed build and enforce a relaunch, since pending updates are inert until restart. Because exploitation requires loading malicious content, effective compensating controls until patching completes include enabling Chrome's Site Isolation (default) and enterprise policies that block untrusted sites, and deploying web/DNS filtering to reduce exposure to attacker-controlled pages - with the trade-off that filtering cannot cover malvertising or compromised legitimate sites. Chromium-based browser users should apply the equivalent vendor updates once released.