What is the CVSS score of EUVD-2026-42488?

EUVD-2026-42488 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-42488?

Google Chrome versions before 150.0.7871.115 contain a code execution vulnerability in the Payments component with no public exploit identified.. A patch is available.

How to fix or mitigate EUVD-2026-42488?

Within 24 hours: Deploy Chrome version 150.0.7871.115 or later to all managed endpoints via automatic updates or system administration tools. Within 7 days: Verify deployment completion and monitor for exploitation attempts in security logs. Within 30 days: Audit unmanaged devices and enforce Chrome auto-update policy to prevent future patching delays.

Google Chrome EUVD-2026-42488

| CVE-2026-15117 HIGH

Use After Free (CWE-416)

2026-07-08 chrome-cve-admin@google.com

GHSA-r7m5-ccww-9j78

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted page (AV:N) with no auth (PR:N) but mandatory payment UI gestures (UI:R) and a race/heap-grooming UAF (AC:H); successful exploitation yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:42 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 08, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Payments component (versions prior to 150.0.7871.115) lets a remote attacker who lures a user into performing specific UI gestures potentially achieve code execution via a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 7.5, with a vendor patch already shipped in the July 2026 Stable channel update; no public exploit has been identified at time of analysis. Exploitation is gated by high attack complexity and required user interaction, making it credible but not trivially weaponizable.

Technical ContextAI

The vulnerability lives in Chrome's Payments subsystem, the browser component that handles the Payment Request / Web Payments API and associated UI flows (e.g. payment sheets, autofill of card data). Per CWE-416 (Use After Free), the root cause is that a heap object tied to the payment flow is freed while a dangling pointer to it is still reachable; subsequent use of that pointer produces heap corruption. Because the trigger requires 'specific UI gestures,' the free is likely provoked by an object lifetime race between the payment UI state and JavaScript-driven page/DOM changes on a crafted HTML page. The affected CPE is the Google Chrome desktop browser (Blink/Chromium engine) on all desktop platforms served by the Stable channel; successful heap grooming of a UAF in the renderer or browser process is the classic path toward arbitrary code execution within Chrome's process model.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.115 or later via the Chrome Releases Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html) and restart the browser to apply - enterprise fleets should push the update through their managed-update/Group Policy channel and force a relaunch, since Chrome only completes the swap after restart. No standalone workaround is published; because the trigger is user-interaction-driven on the Payments flow, interim risk can be reduced by user awareness (avoid engaging with untrusted payment prompts/gestures) and by keeping Chrome's site isolation and sandbox enabled, but these do not fully remediate the UAF and should not substitute for the patch. Users of other Chromium-based browsers should apply their respective vendor updates once the Chromium fix is merged downstream.