What is the CVSS score of EUVD-2026-46129?

EUVD-2026-46129 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-46129?

Google Chrome prior to version 150.0.7871.128 contains a high-severity information disclosure vulnerability (CVSS 8.8) that enables remote extraction of sensitive data when users visit malicious…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-46129?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46129. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-46129?

Within 24 hours, audit Chrome version distribution across the enterprise to identify all systems running versions prior to 150.0.7871.128 using your asset management system. Within 7 days, deploy Chrome 150.0.7871.128 or later organization-wide through your standard patch channel (SCCM, Intune, MDM, or equivalent browser deployment mechanism); prioritize administrative workstations and systems processing sensitive information. By day 30, achieve full deployment compliance through automated endpoint compliance scanning and reinforce user security awareness messaging addressing the risk of untrusted website visits.

Google Chrome EUVD-2026-46129

| CVE-2026-15903 HIGH

Out-of-bounds Read (CWE-125)

2026-07-20 vendor:ubuntu

GHSA-wwqm-cwjr-9577

Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

A remote malicious page needs no privileges but requires the user to visit it (UI:R); an information-disclosure flaw drives high confidentiality with limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 16:22 NVD

8.8 (HIGH)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Information disclosure in Google Chrome prior to 150.0.7871.128 allows a remote attacker to leak sensitive data after luring a user to a malicious web page, per the Chrome stable channel update. The CVSS 3.1 score of 8.8 reflects network reach with only user interaction required, and a vendor patch is available. No public exploit identified at time of analysis, and EPSS estimates a low ~0.29% probability of near-term exploitation.

Technical ContextAI

The affected component is Google Chrome, the Chromium-based desktop web browser, on the stable release channel below build 150.0.7871.128. The vulnerability is tracked internally as Chromium issue 531503216 and categorized under the Information Disclosure tag, indicating a class of flaw where the browser exposes memory contents or cross-origin data that should be isolated. No CWE was assigned in the provided data, but Information Disclosure in Chrome typically maps to CWE-200 (Exposure of Sensitive Information) and is frequently rooted in memory-safety or same-origin-policy enforcement issues within Chrome's rendering, JavaScript, or graphics subsystems. Because Chromium is the upstream engine for many downstream browsers (Edge, Brave, Opera, Electron apps), the underlying defect may extend beyond Chrome itself.

RemediationAI

Vendor-released patch: update Google Chrome to version 150.0.7871.128 or later via the Chrome Releases stable channel advisory (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html). Most installations receive this automatically, but administrators should force it by opening chrome://settings/help to trigger a version check and relaunch, or push the build through enterprise management (Google Update / Chrome Browser Cloud Management) to guarantee coverage on locked-down or offline fleets. Until the update is applied, reduce exposure by avoiding untrusted web pages and keeping Chrome's site isolation enabled; note that broadly disabling browser features harms usability and is a weaker control than simply applying the fix. Verify that downstream Chromium browsers (Edge, Brave, Opera) have shipped their own rebased builds before treating them as safe.