Description
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-07-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in Chrome’s Views component that can be triggered by a specially crafted HTML page. This flaw corrupts heap memory used by the browser process, potentially allowing an attacker to execute arbitrary code with the same privileges as the user running Chrome. The weakness is classified as CWE‑416, a heap use‑after‑free condition.

Affected Systems

Google Chrome versions before 150.0.7871.115 are affected. The issue applies to all desktop builds of Chrome released prior to that version, regardless of the operating system.

Risk and Exploitability

Chromium rates this issue as Critical, underscoring a high potential impact. The EPSS score is less than 1 %, indicating a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring a user to open a malicious web page; thus exploitation depends on user interaction. Despite the low EPSS, the combination of a heap corruption flaw and high severity suggests that the overall risk remains significant.

Generated by OpenCVE AI on July 9, 2026 at 23:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 150.0.7871.115 or newer.
  • Enable Chrome’s Safe Browsing and SmartScreen features to block malicious sites.
  • Keep the operating system and all security software up to date to reduce the overall attack surface.

Generated by OpenCVE AI on July 9, 2026 at 23:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Vulnerability in Chrome Views Allowing Heap Corruption

Thu, 09 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 08 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Description Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-09T10:19:09.354Z

Reserved: 2026-07-08T17:07:44.223Z

Link: CVE-2026-15129

cve-icon Vulnrichment

Updated: 2026-07-09T10:18:02.850Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-09T23:30:16Z

Weaknesses