What is the CVSS score of CVE-2026-16415?

CVE-2026-16415 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-16415?

Yes, a patch is available for CVE-2026-16415. Update the affected software to the latest version immediately.

Google CVE-2026-16415

EUVD-2026-47570 MEDIUM

Improper Input Validation (CWE-20)

2026-07-21 chrome-cve-admin@google.com

GHSA-jc3p-7w2v-rw3c

Information Disclosure Google Suse

Medium

Disputed · 5.4 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:25 vuln.today

CVSS changed

Jul 24, 2026 - 13:22 NVD

5.4 (MEDIUM)

CVE Published

Jul 21, 2026 - 23:16 cve.org

MEDIUM 5.4

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.