What is the CVSS score of EUVD-2026-42487?

EUVD-2026-42487 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-42487?

Google Chrome prior to version 150.0.7871.115 is vulnerable to remote code execution when users visit malicious webpages, creating an attack surface for any organization using Chrome on employee…. A patch is available.

How to fix or mitigate EUVD-2026-42487?

Within 24 hours: Deploy communication requiring all users to update Google Chrome to version 150.0.7871.115 or later; confirm that Chrome auto-update is enabled in your environment. Within 7 days: Validate that 100% of endpoints have reached the patched version through vulnerability scanning or endpoint management tools. Within 30 days: Review endpoint detection and response (EDR) logs for any evidence of exploitation attempts targeting this CVE.

Google Chrome EUVD-2026-42487

| CVE-2026-15116 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-rf8j-gp6c-595q

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); sandbox-confined RCE keeps scope Unchanged with high C/I/A within the renderer.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:41 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

8.8 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 150.0.7871.115 lets a remote attacker run arbitrary code (constrained to the renderer sandbox) by luring a victim to a crafted HTML page that triggers a use-after-free in the Actor component. The flaw is network-reachable and requires only that the user visit a malicious page, but Chromium rates the severity High rather than Critical because code execution stays inside the renderer sandbox. No public exploit identified at time of analysis; no EPSS or KEV signal was supplied in the input.

Technical ContextAI

The bug is a CWE-416 use-after-free in Chrome's 'Actor' subsystem, meaning a heap object is freed while a dangling reference to it is still used, allowing an attacker to reclaim the freed allocation with controlled data and hijack subsequent object accesses (vtable pointers, function callbacks) to gain code execution. Chrome's renderer processes parse untrusted HTML/JS from any website, so a crafted page can drive the vulnerable code path directly. Per the EUVD affected-version data the flaw exists in Chrome builds prior to 150.0.7871.115 on desktop; execution is confined to the renderer sandbox, so a successful exploit would typically need to be chained with a separate sandbox-escape bug to compromise the host OS.

RemediationAI

Patch available per vendor advisory: update Google Chrome to 150.0.7871.115 or later on all desktop platforms via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html, then fully restart the browser so the new build is loaded (Chrome auto-updates but the relaunch is required to apply it). In managed fleets, push the update through your endpoint/browser-management tooling and verify the running version via chrome://settings/help. Users of Chromium-based browsers should apply their vendor's corresponding update once released. As an interim compensating control before patching, limit exposure by having users avoid untrusted sites and consider enabling Chrome's site-isolation and enhanced Safe Browsing; note these reduce but do not eliminate risk since any crafted page can trigger the flaw, so they are not a substitute for the update.