CVE-2026-15902Disclosure(google / chrome)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch google chrome systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

google CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html

Other references

https://issues.chromium.org/issues/522436154

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-07-20); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

google

Products

chrome

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	3	Disclosure2Patch1
2026-07-21	1	Disclosure1

Full discourse4 posts

Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-15902 Use After Free in Google Chrome Prior to 150.0.7871.128 Remote Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15902
Post summary
The snippet announces a use‑after‑free remote code execution vulnerability in Google Chrome versions older than 150.0.7871.128.
0000087
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-15902 Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromiu… https://www.cve.org/CVERecord?id=CVE-2026-15902 ----- Traducción: CVE-2026-15902 Uso… http://infoflow.cloud`
Post summary
The excerpt announces CVE‑2026‑15902 as a use‑after‑free vulnerability in Chrome’s Cast component that enables remote code execution with a crafted HTML page, but it does not provide a PoC, exploit code, or patch information.
0000028
93 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-15902 Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromiu… https://www.cve.org/CVERecord?id=CVE-2026-15902
Post summary
CVE-2026-15902 reveals a use‑after‑free vulnerability in Chrome's Cast component that permits remote code execution via a crafted HTML page; no PoC, exploit, or patch details are disclosed.
00000845
57.8K followersView on X
TECHEPAGES@techepages92d
Patch
🚨 🚨 Google's issued its 2nd critical Chrome update in just 48 hours (150.0.7871.128/.129). It patched 7 security vulnerabilities in the browser. 🔴 CVE-2026-15899 — UAF in CameraCapture 🔴 CVE-2026-15900 — UAF in GPU 🔴 CVE-2026-15901 — UAF in Network 🟠 CVE-2026-15902 — UAF in Cast 🟠 CVE-2026-15903 — OOB read/write in V8 (found by OpenAI Codex Security) 🟠 CVE-2026-15904 — UAF in Ozone 🟠 CVE-2026-15905 — UAF in Aura No active exploitation reported. Update now 🌐🔒
Post summary
Google released a critical Chrome update that patched seven UAF and OOB vulnerabilities (CVE-2026-15899 to CVE-2026-15905) with no reported active exploitation.
0000065
29 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	chrome	-	-	-

Explore more

Back to dashboard google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-15902

TECHEPAGES[verified]@techepagesPatch

Google released a critical Chrome update that patched seven UAF and OOB vulnerabilities (CVE-2026-15899 to CVE-2026-15905) with no reported active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The snippet announces a use‑after‑free remote code execution vulnerability in Google Chrome versions older than 150.0.7871.128.

Infoflowcloud@infoflowcloudDisclosure

The excerpt announces CVE‑2026‑15902 as a use‑after‑free vulnerability in Chrome’s Cast component that enables remote code execution with a crafted HTML page, but it does not provide a PoC, exploit code, or patch information.

CVE@CVEnewDisclosure

CVE-2026-15902 reveals a use‑after‑free vulnerability in Chrome's Cast component that permits remote code execution via a crafted HTML page; no PoC, exploit, or patch details are disclosed.