What is the CVSS score of EUVD-2026-44473?

EUVD-2026-44473 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-44473?

Yes, a patch is available for EUVD-2026-44473. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-44473

| CVE-2026-15766 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-14 Chrome

GHSA-mc7h-7x47-9j48

Information Disclosure Google Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page with no privileges required (AV:N, PR:N), user must visit page (UI:R), high confidentiality loss from memory disclosure (C:H), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:31 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVSS changed

Jul 14, 2026 - 21:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 14, 2026 - 20:09 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory use in Chrome's Skia graphics library exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 150.0.7871.125. An unauthenticated remote attacker can trigger the leak by inducing a user to visit a crafted HTML page, causing the Skia renderer to read and disclose uninitialized memory contents. No public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none, though the CVSS Confidentiality impact is rated High given the potential for in-memory secrets exposure.

Technical ContextAI

Skia is Google's open-source 2D graphics rendering library embedded in Chrome (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and used for all visual content rendering. CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where a variable or buffer is consumed before being assigned a defined value, causing whatever bytes happened to occupy that memory region to be returned or processed. In Chrome's context, this manifests in the Skia rendering pipeline when processing specially structured HTML or graphical content, allowing uninitialized heap or stack memory to be surfaced and potentially exfiltrated. This class of flaw can expose residual in-memory data such as tokens, credentials, or cryptographic material that happened to occupy the uninitialized region.

RemediationAI

Update Google Chrome to version 150.0.7871.125 or later, which contains the vendor-released patch for this vulnerability. The desktop stable channel update is documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. ChromeOS users should apply the corresponding ChromeOS stable channel update at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-chromeos_01375142362.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify rollout via Google Admin Console or Chrome browser cloud management. As a temporary compensating control, enabling Chrome's strict site isolation (chrome://flags/#enable-site-per-process, enabled by default on most platforms) limits cross-origin memory leakage scope. Restricting user navigation to untrusted or unverified web content reduces exposure but is not operationally viable in most environments.