Vulnary
← back to the feed
Critical· 9.6official fix available

CVE-2026-15900

A critical use‑after‑free flaw in the GPU component of Google Chrome on Android lets a remote attacker escape the browser sandbox by tricking a user into opening a malicious HTML page. The vulnerability affects Chrome versions before 150.0.7871.128 and has a CVSS score of 9.6. Updating Chrome to the patched version resolves the issue.

publishedJul 20, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.6
critical · how bad it is
exploitation · epss
<1%
15th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 22, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Users of Google Chrome on Android running versions earlier than 150.0.7871.128.

02

Real-world impact

An attacker could craft a web page that, when visited, triggers the use‑after‑free condition and gains elevated privileges to escape the Chrome sandbox, potentially leading to further system compromise.

03

Why this severity

The CVSS v3.1 base score of 9.6 (Critical) reflects a network‑attackable vector with low complexity, no privileges or user interaction required beyond loading a page, and high impacts to confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 011. Open Google Chrome on your Android device.
  2. 022. Go to Settings → About Chrome (or Play Store → My apps & games → Update).
  3. 033. Ensure Chrome is updated to version 150.0.7871.128 or later.
  4. 044. Restart Chrome if the update does not automatically relaunch the browser.

NVD description indicating the fixed version (150.0.7871.128).

05

Timeline

  1. Jul 20, 2026 · 12d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 23, 2026 · 10d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Jul 24, 2026 · 9d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →