Multiple vulnerabilities in Google Chrome (July 09, 2026)

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to cause an unspecified security issue.

Who is affected

Users of Google Chrome are affected by these vulnerabilities.

Urgency

Remediation is urgent as the unspecified security issues could lead to exploitation.

Action

Update Google Chrome to the latest version to address these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-FR Avis de sécurité (FR · national-cert · site)

Severity

unknown

Published

2026-07-09

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0848/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-151180.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151250.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151300.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151200.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151120.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151150.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151210.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151240.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151090.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-151100.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownMultiple vulnerabilities in Palo Alto Networks products (August 13, 2026)cert-fr-avis
• high[NEW] [high] Google Chrome: Multiple vulnerabilitiescert-bund
• unknownMultiple Vulnerabilities in Microsoft Edge (July 29, 2026)cert-fr-avis
• unknownCVE-2026-15107: Chromium: CVE-2026-15107 Use after free in IndexedDBmsrc
• unknownCVE-2026-15125: Chromium: CVE-2026-15125 Inappropriate implementation in Formsmsrc
• unknownCVE-2026-15124: Chromium: CVE-2026-15124 Insufficient policy enforcement in Passwordsmsrc
• unknownCVE-2026-15128: Chromium: CVE-2026-15128 Inappropriate implementation in Formsmsrc
• unknownCVE-2026-15113: Chromium: CVE-2026-15113 Use after free in Autofillmsrc
• unknownCVE-2026-15123: Chromium: CVE-2026-15123 Insufficient data validation in DOMmsrc
• unknownCVE-2026-15118: Chromium: CVE-2026-15118 Use after free in Inputmsrc
• unknownCVE-2026-15121: Chromium: CVE-2026-15121 Use after free in WebRTCmsrc
• unknownCVE-2026-15120: Chromium: CVE-2026-15120 Use after free in Coremsrc

Recent advisories for Google Chrome

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownGoogle Chrome Multiple Vulnerabilitieshkcert · 2026-08-26
• unknownCVE-2026-79293: Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacke…nvd · 2026-08-25
• unknownCVE-2026-79292: Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attack…nvd · 2026-08-25
• unknownCVE-2026-79291: Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to o…nvd · 2026-08-25
• unknownCVE-2026-79290: Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to ex…nvd · 2026-08-25
• unknownCVE-2026-79289: Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0…nvd · 2026-08-25

More from CERT-FR Avis de sécurité

• unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
• unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
• unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
• unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
• unknownVulnerability in SPIP (August 21, 2026)2026-08-21