CVE-2026-15903Disclosure(google / chrome)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch google chrome systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

google CVEs Back to dashboard

2.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html

Other references

https://issues.chromium.org/issues/531503216

Weakness type (CWE)

CWE-125CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
36 mentions across 13 observed days
Momentum state: declining

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 18 signals
Technical details provided in 23 signals
Disclosure: 16 classified signals
General: 10 classified signals
Peaked 8d ago at 9 mentions (2026-08-11); latest day: 1
36 total mentions across 13 days

Affected systems

Vendors

google

Products

chrome

Deep dive

Activity timeline36 mentions / 13d

Signal classification4 categories

Disclosure

1644.4%

General

1027.8%

Patch

822.2%

PoC

25.6%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-18	1	Disclosure1
2026-07-20	3	Disclosure1General1Patch1
2026-07-21	1	General1
2026-08-10	3	Disclosure1General2
2026-08-11	9	Disclosure4General3Patch1PoC1
2026-08-12	4	Disclosure3General1
2026-08-13	2	Disclosure1General1
2026-08-14	1	Disclosure1
2026-08-15	5	Disclosure1General1Patch3
2026-08-16	3	Patch2PoC1
2026-08-17	1	Disclosure1
2026-08-18	2	Disclosure2
2026-08-19	1	Patch1

Full discourse20 posts

Tiger@screenest_ai68d
PoC
GPT-5.6-Cyber found CVE-2026-15903 in Chrome's V8 engine. The diagram shows the exploit chain: a JIT type error creates out-of-bounds memory access. A JSPI argument mismatch then enables native code execution. It connected separate failures into one exploitable path. https://t.co/gF62J1z6aB
Post summary
A diagram detailing the exploit chain for CVE-2026-15903 in Chrome's V8 engine was shared, highlighting a JIT type error that triggers out-of-bounds memory access leading to native code execution via a JSPI argument mismatch.
00012153
265 followersView on X
Marius Laurusevicius@MLaurusevicius65d
Patch
Two previously unknown V8 flaws chain together to escape Chrome's sandbox. Google patched them as CVE-2026-15903. It is the one claim here confirmed outside OpenAI. Under NIS2 Article 23 you have 24 hours to file an early warning. Discovery sped up.
Post summary
Google patched two previously unknown V8 sandbox‑escape flaws (CVE‑2026‑15903) with no evidence of active exploitation or PoC disclosure.
2000055
30 followersView on X
peesamac@peesamac67d
Disclosure
ของจริงที่เอาไปใช้แล้วคือ OpenAI บอกว่าเจอช่องโหว่ที่ไม่เคยมีใครรู้มาก่อน 2 รายการใน V8 engine ของ Chrome รวมถึง chain ที่หลุดออกจาก V8 heap sandbox ได้ แล้วรายงานให้ Google แก้ไป (CVE-2026-15903) นอกจากนี้ยังเจอช่องโหว่ในระบบ mobile OS ฐานข้อมูล และ OS kernel อีกหลายร้อยรายการ
Post summary
OpenAI disclosed a previously unknown CVE‑2026‑15903 affecting the V8 engine in Chrome, with a sandbox escape chain, reported to Google for repair.
1100070
1.5K followersView on X
Arjun Gupta@arjun_gupta9567d
Disclosure
AI just helped find two zero-days in V8, Chrome’s JavaScript engine. GPT-5.6-Cyber helped @OpenAI researchers uncover a chain that could corrupt memory and escape the V8 heap sandbox. Google patched the issue as CVE-2026-15903. The cyber-defense window is getting smaller.
Post summary
AI assistance revealed zero‑day vulnerabilities in Chrome's V8 engine, leading to a Google patch for CVE‑2026‑15903; no exploit code or active exploitation has been reported.
10001149
417 followersView on X
leo@stymsj68d
Disclosure
It runs behind Daybreak Red, a vetted access tier. Findings include CVE-2026-15903, an out-of-bounds read and write in Chrome's V8 engine at CVSS 8.8, patched mid-July, and over 400 privilege-escalation bugs in one OS kernel.
Post summary
The text announces the discovery of CVE-2026-15903, a Chrome V8 out-of-bounds read/write (CVSS 8.8) that was patched mid‑July, while also noting a large number of privilege‑escalation bugs in an OS kernel.
1001074
4 followersView on X
FutureLoop AI@FutureLoopAI69d
Patch
It's already finding real bugs: OpenAI says it used GPT-5.6-Cyber to uncover two previously unknown vulnerabilities in V8, Chrome's JavaScript engine, that could be chained to escape its sandbox. Reported responsibly, now fixed as CVE-2026-15903.
Post summary
OpenAI uncovered two previously unknown vulnerabilities in Chrome's V8 JavaScript engine that could be chained to escape the sandbox, and a patch has been released for CVE‑2026‑15903.
1001077
10 followersView on X
VulDB 🛡@vuldb92d
Disclosure
There is a new vulnerability with elevated criticality in Google Chrome (CVE-2026-15903) https://vuldb.com/vuln/380091
Post summary
A new high‑severity vulnerability (CVE‑2026‑15903) affecting Google Chrome is announced.
00020197
2.3K followersView on X
Cyber Warriors Meetup@CWMCommunity61d
Disclosure
Google confirmed CVE-2026-15903, a High-severity V8 vulnerability in Chrome, was reported by OpenAI Codex Security. It could allow arbitrary code execution inside Chrome’s sandbox via a crafted HTML page. Update Chrome. Stay secure. #CyberSecurity #AI #Chrome https://t.co/HZgAS1yPue
Post summary
Google publicly disclosed CVE‑2026‑15903, a high‑severity V8 sandbox escape that could enable arbitrary code execution from a crafted HTML page, and urged users to update Chrome.
0001089
9 followersView on X
Vikas(Vik) Malpani| AI for US Real Estate@vikasmalpani64d
Patch
The model is OpenAI's GPT-5.6-Cyber, released Aug 10. Pointed at V8, the JavaScript engine inside Chrome, it surfaced two previously unknown flaws that could be chained to corrupt memory and escape the browser sandbox. Google patched them as CVE-2026-15903.
Post summary
Google has released a patch for a newly discovered V8 memory corruption and sandbox escape flaw (CVE‑2026‑15903) that surfaced following the release of OpenAI's GPT‑5.6‑Cyber.
1000066
3.5K followersView on X
Carson Rodrigues@carsonmarz64d
PoC
The model already earned its keep. CVE-2026-15903, an out-of-bounds read and write bug in Chrome's V8 engine, CVSS 8.8. GPT-5.6-Cyber found it and chained it toward a full sandbox escape.
Post summary
The message reports a new CVE‑2026‑15903 OOB read/write flaw in Chrome's V8 engine (CVSS 8.8) that was discovered by GPT‑5.6‑Cyber and linked to a sandbox escape, but it lacks explicit PoC code or mitigation details.
1000046
139 followersView on X
【公式】株式会社カンマン comman inc.@comman_official64d
Patch
【4/5 OpenAIがGPT-5.6-Cyberを提供】 8月11日発表。新区分「Daybreak Red」経由で、Accenture・Cisco等の審査済み企業に限定提供されます。同モデルはChrome V8の脆弱性（CVE-2026-15903／CVSS 8.8）を発見し、Googleが7月に修正しました。攻防両面の能力を持つ点に留意が必要です。
Post summary
OpenAI announced GPT‑5.6‑Cyber, noting they discovered CVE‑2026‑15903 in Chrome V8, which Google patched in July; no PoC or active exploitation details are provided.
1000077
1.8K followersView on X
Don@DonBriefing64d
Disclosure
Friday they paused Astra. Could not rule out Critical cyber. Monday they shipped GPT-5.6-Cyber. Trained to refuse less on dual-use work. Daybreak Red only. Vetting. Hardware keys coming in September. It found two zeros in Chrome's V8. Google patched. CVE-2026-15903. Then more than four hundred privilege-escalation finds in one popular kernel — names still sealed. Disclosure running. Same house. One model held. One model handed to a short list. When the family sells the lockpick and locks the stronger sibling in the vault — who is the customer, and who is the witness? #OpenAI #Cybersecurity
Post summary
The passage announces that Google identified two zero‑day vulnerabilities in Chrome’s V8 (CVE‑2026‑15903) and patched them, with no evidence of active exploitation or publicly shared PoC.
0001093
11 followersView on X
Dispatchy@dispatchy_ai65d
General
OpenAI split Daybreak - Blue for defenders, Red for vetted GPT-5.6-Cyber. GPT-5.6-Cyber completed 95% of advanced tasks; found 2 V8 bugs (CVE-2026-15903), several DB flaws and >400 kernel privilege-escalation vulnerabilities in one OS kernel. Dual-use is explicit.
Post summary
The post reports that GPT‑5.6‑Cyber discovered CVE‑2026‑15903 and numerous other kernel privilege‑escalation issues, but offers no deeper technical, exploit, or patch information.
1000049
38 followersView on X
おかぴ｜@AI副業40代会社員@okapi_fukugyo66d
General
【GPT-5.6-Cyber / Daybreak Red】・8/10にリリース。認定済みセキュリティ専門家のみがアクセス可能・高度なサイバー要求への応答率95%（通常のSolは1.5%）・Chromeの未知の脆弱性を実際に発見（CVE-2026-15903）・「Astraは止めつつ、防御側にはサイバー特化モデルを渡す」というOpenAIの二面構成が鮮明に
Post summary
The post announces the discovery of a previously unknown Chrome vulnerability (CVE-2026-15903) but offers no technical details, exploitation evidence, or mitigation steps.
10000163
1.4K followersView on X
thomi rose@thomi_rose68d
Disclosure
It runs behind Daybreak Red, a vetted access tier. Findings include CVE-2026-15903, an out-of-bounds read and write in Chrome's V8 engine at CVSS 8.8, patched mid-July, and over 400 privilege-escalation bugs in one OS kernel.
Post summary
A newly disclosed out-of-bounds read/write flaw (CVE-2026-15903) in Chrome's V8 engine, CVSS 8.8, was patched mid‑July, alongside an unrelated large set of privilege‑escalation bugs.
1000064
12 followersView on X
Nithin Stephen Raphael@RaphaelNithin68d
Disclosure
In a new cyber update, @OpenAI says GPT-5.6-Cyber completed 95% of its internal advanced-cyber request eval versus 1.5% for GPT-5.6 Sol. Access is limited to vetted Daybreak Red users. @OpenAI also says the model found a V8 bug @Google fixed as CVE-2026-15903.
Post summary
OpenAI’s model identified a V8 engine bug later fixed by Google and assigned CVE‑2026‑15903; no exploit or PoC details are offered, but a patch is mentioned.
1000070
45 followersView on X
追AI的人@yuemingruiteng69d
Disclosure
🔒 OpenAI 发布网络安全模型 GPT-5.6-Cyber，并扩容 Daybreak 防御计划。实测中它排查 Chrome 的 V8 引擎，挖出两个此前未知漏洞、可串联绕过沙箱，其一已获 CVE-2026-15903 编号并被谷歌修复。AI 攻防对抗正式升级。来源：https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/ https://t.co/zEJggHhLm1
Post summary
OpenAI’s new cybersecurity model uncovered CVE-2026-15903 in Chrome’s V8 engine, which Google has already patched; no exploit or active use is reported.
1000065
22 followersView on X
Future-is-good@Futureisgood_69d
General
5 🛡️ OpenAI launches GPT-5.6-Cyber through Daybreak Red. The model reportedly detected two Chrome and V8 zero-days, including CVE-2026-15903. https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/
Post summary
OpenAI announces that its new GPT‑5.6‑Cyber model detected two previously unknown Chrome/V8 zero‑days, including CVE‑2026‑15903, but no details on exploitation, patches, or PoC are provided.
1000074
14 followersView on X
Emmanuel Vivier@emmanuelvivier69d
General
5 🛡️ OpenAI lance GPT-5.6-Cyber via Daybreak Red. Le modele aurait deja detecte deux failles zero-day dans Chrome et V8, dont CVE-2026-15903. https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/
Post summary
OpenAI claims its GPT‑5.6‑Cyber model detected CVE‑2026‑15903 as a zero‑day in Chrome/V8, but no PoC, exploit, patch, or detailed technical information is provided.
1000099
19.3K followersView on X
Die KI WOCHE - mit Markus Kirchmair@kiwoche69d
Disclosure
OpenAI startet GPT-5.6-Cyber in Daybreak Red. Der Hersteller meldet 95,0 % Abschlussrate und zwei gefundene Chrome-V8-Lücken - inklusive CVE-2026-15903. https://kiwoche.com/1161/openai-daybreak-gpt-5-6-cyber-security-modelle?utm_source=x&utm_medium=social&utm_campaign=artikel_1161 (mit KI generiert, vom Menschen freigegeben) https://t.co/h1kXpmChA8
Post summary
OpenAI reports the discovery of CVE-2026-15903 as one of two Chrome V8 bugs, without providing exploitation details or mitigation information.
0001059
31 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	chrome	-	-	-

Explore more

Back to dashboard google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-15903

Tiger[verified]@screenest_aiPoC

A diagram detailing the exploit chain for CVE-2026-15903 in Chrome's V8 engine was shared, highlighting a JIT type error that triggers out-of-bounds memory access leading to native code execution via a JSPI argument mismatch.

Marius Laurusevicius[verified]@MLauruseviciusPatch

Google patched two previously unknown V8 sandbox‑escape flaws (CVE‑2026‑15903) with no evidence of active exploitation or PoC disclosure.

peesamac[verified]@peesamacDisclosure

OpenAI disclosed a previously unknown CVE‑2026‑15903 affecting the V8 engine in Chrome, with a sandbox escape chain, reported to Google for repair.

Arjun Gupta[verified]@arjun_gupta95Disclosure

AI assistance revealed zero‑day vulnerabilities in Chrome's V8 engine, leading to a Google patch for CVE‑2026‑15903; no exploit code or active exploitation has been reported.

FutureLoop AI[verified]@FutureLoopAIPatch

OpenAI uncovered two previously unknown vulnerabilities in Chrome's V8 JavaScript engine that could be chained to escape the sandbox, and a patch has been released for CVE‑2026‑15903.

Vikas(Vik) Malpani| AI for US Real Estate[verified]@vikasmalpaniPatch

Google has released a patch for a newly discovered V8 memory corruption and sandbox escape flaw (CVE‑2026‑15903) that surfaced following the release of OpenAI's GPT‑5.6‑Cyber.

Carson Rodrigues[verified]@carsonmarzPoC

The message reports a new CVE‑2026‑15903 OOB read/write flaw in Chrome's V8 engine (CVSS 8.8) that was discovered by GPT‑5.6‑Cyber and linked to a sandbox escape, but it lacks explicit PoC code or mitigation details.

【公式】株式会社カンマン comman inc.[verified]@comman_officialPatch

OpenAI announced GPT‑5.6‑Cyber, noting they discovered CVE‑2026‑15903 in Chrome V8, which Google patched in July; no PoC or active exploitation details are provided.