Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 150.0.7871.115 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 9, 2026

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org

Related CVEs

• FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site ScriptingAlso CWE-79
• UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable SubstitutionAlso CWE-79
• PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments BlockAlso CWE-79
• LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesAlso CWE-79
• Stored XSS in Logo Software's e-Logo Purchasing PortalAlso CWE-79
• Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsSame generic ecosystem

Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 150.0.7871.115 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 9, 2026

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org

Related CVEs

• FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site ScriptingAlso CWE-79
• UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable SubstitutionAlso CWE-79
• PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments BlockAlso CWE-79
• LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesAlso CWE-79
• Stored XSS in Logo Software's e-Logo Purchasing PortalAlso CWE-79
• Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsSame generic ecosystem