CVE-2026-15900Disclosure(google / android)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch google android systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

google CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html

Other references

https://issues.chromium.org/issues/523750584

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android
chrome

Threat summary

Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 5d ago at 3 mentions (2026-07-20); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

google

Products

androidchrome

1 version affected across 2 products

Deep dive

Activity timeline8 mentions / 6d

Signal classification3 categories

Disclosure

450.0%

Patch

337.5%

General

112.5%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	3	Disclosure2Patch1
2026-07-21	1	Disclosure1
2026-07-23	1	Patch1
2026-07-27	1	Patch1
2026-07-30	1	General1
2026-08-01	1	Disclosure1

Full discourse8 posts

connect24h@connect24h89d
Patch
ブラウザ更新を利用者任せにするな。これは全社対応案件だ。 Chrome 150は7月14日と16日の2回で計22件を修正し、うち5件がCritical。CVE-2026-15899、CVE-2026-15900、CVE-2026-15901はCameraCapture、GPU、NetworkのUse after freeだ。実悪用確認の記載はないが、業務の入口で待つ理由はない。自分ならEDRやMDMで150.0.7871.128/.129以上を棚卸しし、未達端末へ更新とChrome再起動を促す。chrome://settings/helpを案内して終わらず、全社の反映率まで追ってほしい。CSIRTの初動確認に保存推奨。 #セキュリティソース: https://www.jpcert.or.jp/wr/2026/wr260723.html#2
Post summary
The advisory highlights critical Chrome 150 CVEs with no confirmed exploitation, urging a full‑organization patch rollout and EDR/MDM updates.
040851.4K
7.0K followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker80d
Disclosure
【緊急】CVE-2026-15900 Google Chrome Android版 150.0.7871.128以前に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/28/cve-2026-15900-google-chrome-android-15007871128/ #IT #Security #cybersecurity
Post summary
The post alerts to a critical vulnerability in Chrome for Android versions up to 150.0.7871.128, but offers no details about the flaw, its exploitation, or a fix.
0001045
210 followersView on X
kawn@kawn202085d
Patch
Google が，Chrome 150.0.7871.128/.129 (Windows および Mac) および 150.0.7871.128 (Linux) をリリース． CVE ベースで 7 件（Critical 3 件　・CVE-2026-15899 　・CVE-2026-15900 　・CVE-2026-15901 High 4 件）の脆弱性に対処． https://x.com/kawn2020/status/2081549327282196623
Post summary
Google released Chrome 150.0.7871.128/129 to patch seven CVEs, including three critical and four high‑severity vulnerabilities.
1000051
92 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-15900 Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… https://www.cve.org/CVERecord?id=CVE-2026-15900
Post summary
The text announces CVE-2026-15900, a use‑after‑free in Chrome’s GPU on Android that could allow a sandbox escape through a crafted HTML page, but offers no PoC, exploit code, or patches.
00010945
57.8K followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker82d
General
【緊急】CVE-2026-15900 Google Chrome Android版 150.0.7871.128以前に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/28/cve-2026-15900-google-chrome-android-15007871128/ #IT #Security #cybersecurity
Post summary
The text announces a serious vulnerability (CVE‑2026‑15900) affecting older Chrome for Android, urging immediate action, but it offers no further detail on exploitation, remediation, or technical specifics.
0000059
210 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-15900 Use After Free in Google Chrome GPU on Android Prior to 150.0.787... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15900 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE‑2026‑15900 as a use‑after‑free issue in Google Chrome's GPU code on Android versions prior to 150.0.787, linking to a vulnerability detail page for further information.
0000091
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-15900 Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… https://www.cve.org/CVERecord?id=CVE-2026-15900 ----- Traducción: CVE-2026-15900 Use… http://infoflow.cloud`
Post summary
Disclosed a use-after-free vulnerability (CVE‑2026‑15900) in Google Chrome on Android that could lead to sandbox escape via a crafted HTML page; no Proof‑of‑Concept, exploitation evidence, or patch information provided.
0000031
93 followersView on X
TECHEPAGES@techepages92d
Patch
🚨 🚨 Google's issued its 2nd critical Chrome update in just 48 hours (150.0.7871.128/.129). It patched 7 security vulnerabilities in the browser. 🔴 CVE-2026-15899 — UAF in CameraCapture 🔴 CVE-2026-15900 — UAF in GPU 🔴 CVE-2026-15901 — UAF in Network 🟠 CVE-2026-15902 — UAF in Cast 🟠 CVE-2026-15903 — OOB read/write in V8 (found by OpenAI Codex Security) 🟠 CVE-2026-15904 — UAF in Ozone 🟠 CVE-2026-15905 — UAF in Aura No active exploitation reported. Update now 🌐🔒
Post summary
Google released a critical Chrome update addressing seven newly disclosed UAF and OOB vulnerabilities; no active exploitation has been reported.
0000065
29 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	-	-	-
App	google	chrome	-	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2026-15900

connect24h[verified]@connect24hPatch

The advisory highlights critical Chrome 150 CVEs with no confirmed exploitation, urging a full‑organization patch rollout and EDR/MDM updates.

TECHEPAGES[verified]@techepagesPatch

Google released a critical Chrome update addressing seven newly disclosed UAF and OOB vulnerabilities; no active exploitation has been reported.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerDisclosure

The post alerts to a critical vulnerability in Chrome for Android versions up to 150.0.7871.128, but offers no details about the flaw, its exploitation, or a fix.

kawn@kawn2020Patch

Google released Chrome 150.0.7871.128/129 to patch seven CVEs, including three critical and four high‑severity vulnerabilities.

CVE@CVEnewDisclosure

The text announces CVE-2026-15900, a use‑after‑free in Chrome’s GPU on Android that could allow a sandbox escape through a crafted HTML page, but offers no PoC, exploit code, or patches.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The text announces a serious vulnerability (CVE‑2026‑15900) affecting older Chrome for Android, urging immediate action, but it offers no further detail on exploitation, remediation, or technical specifics.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE‑2026‑15900 as a use‑after‑free issue in Google Chrome's GPU code on Android versions prior to 150.0.787, linking to a vulnerability detail page for further information.

Infoflowcloud@infoflowcloudDisclosure

Disclosed a use-after-free vulnerability (CVE‑2026‑15900) in Google Chrome on Android that could lead to sandbox escape via a crafted HTML page; no Proof‑of‑Concept, exploitation evidence, or patch information provided.