What is the CVSS score of CVE-2026-16424?

CVE-2026-16424 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-16424?

A critical vulnerability in Google Chrome for Android (prior to version 150.0.7871.182) enables full device compromise when combined with a separate browser exploit.. A patch is available.

How to fix or mitigate CVE-2026-16424?

Within 24 hours, conduct an inventory of Chrome for Android versions across your mobile device fleet using your MDM solution to identify all devices running versions prior to 150.0.7871.182. Within 7 days, deploy Chrome for Android version 150.0.7871.182 or later to all identified devices; if deployment is not immediately feasible due to compatibility constraints, restrict network access for non-compliant devices and escalate for expedited testing. Verify 100% deployment compliance and complete attestation within 30 days, documenting the update timeline for audit and regulatory purposes.

Google CVE-2026-16424

EUVD-2026-47577 CRITICAL

Use After Free (CWE-416)

2026-07-21 chrome-cve-admin@google.com

GHSA-r356-68h4-gpq6

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:23 vuln.today

CVSS changed

Jul 22, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 21, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.