Critical· 9.6official fix available
CVE-2026-15902
CVE-2026-15902 is a critical use-after-free vulnerability in Google Chrome versions prior to 150.0.7871.128. Attackers can exploit it via a crafted HTML page to execute arbitrary code within Chrome's sandbox.
publishedJul 20, 2026
last modifiedJul 23, 2026
sourcesNVD
severity · cvss
9.6
critical · how bad it is
exploitation · epss
<1%
21th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 22, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Google Chrome versions before 150.0.7871.128
02
Real-world impact
Remote code execution in a sandboxed environment
03
Why this severity
CVSS 9.6 (critical): High risk of full system compromise via web-based attacks
04
What to do about it
official fix available
recommended steps
- 011. Upgrade Google Chrome to version 150.0.7871.128 or later.
- 022. Restart the browser after updating.
NVD-referenced vendor advisory (Google Chrome security update)
05
Timeline
- Jul 20, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →