Description
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use-after-free bug in the Chrome Views component, present before version 150.0.7871.115, can be triggered by a malicious webpage that requires specific user gestures, possibly resulting in heap corruption and allowing an attacker to execute arbitrary code or cause a denial of service. The weakness is classified as CWE-416.

Affected Systems

All Google Chrome desktop installations running a version older than 150.0.7871.115, regardless of channel, are vulnerable.

Risk and Exploitability

The exploit demands a user-interactive trigger, such as a click or scroll, and is not listed in the CISA KEV catalog. With an EPSS score below 1 % and a CVSS score of 7.5, real-world exploitation is unlikely but the potential damage if successful is substantial.

Generated by OpenCVE AI on July 31, 2026 at 13:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.115 or newer.
  • Ensure the browser’s auto-update feature is enabled so future patches are applied automatically.
  • As a temporary measure, use a content-filtering extension or safe-browsing service to block malicious sites that attempt to induce unusual user gestures.

Generated by OpenCVE AI on July 31, 2026 at 13:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4677-1 chromium security update
Debian DSA Debian DSA DSA-6387-1 chromium security update
History

Fri, 31 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Views Enables Heap Corruption via Crafted Webpage

Sun, 26 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Views Enables Heap Corruption via Crafted Webpage

Wed, 22 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Views Allows Heap Corruption via Crafted HTML

Thu, 16 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Views Allows Heap Corruption via Crafted HTML

Wed, 15 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free Heap Corruption via Crafted HTML in Google Chrome

Tue, 14 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title Use-After-Free Heap Corruption via Crafted HTML in Google Chrome

Mon, 13 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Heap Corruption in Chrome Views Component

Sun, 12 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Heap Corruption in Chrome Views Component

Sat, 11 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Heap Corruption via Use-After-Free in Chrome Views

Fri, 10 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Heap Corruption via Use-After-Free in Chrome Views

Fri, 10 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Views Enables Potential Heap Corruption and Remote Code Execution

Thu, 09 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Views Enables Potential Heap Corruption and Remote Code Execution

Thu, 09 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 08 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Description Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-10T03:55:32.285Z

Reserved: 2026-07-08T17:07:39.516Z

Link: CVE-2026-15111

cve-icon Vulnrichment

Updated: 2026-07-09T10:31:05.753Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-08T23:16:52.203

Modified: 2026-07-10T05:16:28.347

Link: CVE-2026-15111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:45:03Z

Weaknesses