What is the CVSS score of EUVD-2026-46131?

EUVD-2026-46131 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-46131?

A use-after-free vulnerability in Google Chrome for desktop (CVE-2026-15905) allows remote attackers to execute arbitrary code or exfiltrate sensitive data through malicious websites, affecting all…. A patch is available.

How to fix or mitigate EUVD-2026-46131?

Within 24 hours, distribute notification to all Chrome users and begin staged deployment of Chrome version 150.0.7871.128 through your endpoint management system, prioritizing systems that handle customer data or financial information. Within 7 days, verify that 90% of desktop systems have installed the patch through automated compliance scanning and escalate exceptions to IT teams. Within 30 days, achieve 100% patch deployment by managing remaining systems with technical constraints or applying compensating controls where needed, and document your remediation timeline for audit purposes.

Google Chrome EUVD-2026-46131

| CVE-2026-15905 HIGH

Use After Free (CWE-416)

2026-07-20 vendor:ubuntu

GHSA-j5rv-8p72-245q

Information Disclosure Google Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Browser use-after-free triggered by rendering remote malicious web content, so AV:N with UI:R for a user-visited page; no privileges needed and full CIA impact within the browser process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 13:22 NVD

7.8 (HIGH)

Analysis Generated

Jul 20, 2026 - 14:32 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.

Technical ContextAI

This is a CWE-416 use-after-free defect in Chrome's rendering/browser engine (Chromium codebase, tracked internally as chromium issue 532970574). Use-after-free occurs when code keeps referencing a heap object after it has been freed, allowing an attacker who controls subsequent heap allocations to place controlled data where the dangling pointer still points. In a browser this is typically triggered by crafted HTML, JavaScript, or DOM manipulation that forces premature object destruction while a reference remains live. The affected component runs within Chrome's multi-process model, and successful exploitation of such bugs classically leads to type confusion, information disclosure, and control-flow hijacking - consistent with the reported tags Information Disclosure, Use After Free, and Memory Corruption.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.128 - upgrade all desktop Chrome installations to 150.0.7871.128 or later via the Chrome Releases Stable channel update (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html). Most installs update automatically, so verify auto-update is enabled, fully restart the browser to apply, and confirm the version at chrome://settings/help. For managed fleets, push the update through Group Policy or MDM and audit for endpoints pinned to older builds. Ubuntu and other Chromium-derived distributions should apply the corresponding distribution security update once published. If patching must be delayed, compensating controls include restricting browsing to trusted sites, keeping Chrome site isolation enabled (default), and using URL/content filtering to reduce exposure to untrusted web content - with the trade-off that none of these eliminate the flaw and only lower the chance a user reaches malicious content.