CVE-2026-15905Disclosure(google / chrome)

MEDIUMCVSS 7.8 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch google chrome systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)

google CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html

Other references

https://issues.chromium.org/issues/532970574

Weakness type (CWE)

CWE-416

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-07-20); latest day: 2
7 total mentions across 4 days

Affected systems

Vendors

google

Products

chrome

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Disclosure

457.1%

Patch

228.6%

Active Exploitation

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-18	1	Disclosure1
2026-07-19	1	Active Exploitation1
2026-07-20	3	Disclosure2Patch1
2026-07-21	2	Disclosure1Patch1

Full discourse7 posts

Upwind Security MDR@UpwindMDR89d
Patch
🚨 HIGH - Chrome Aura use-after-free heap corruption via malicious file (CVE-2026-15905) A use-after-free vulnerability exists in the Aura UI component of Google Chrome prior to 150.0.7871.128, where freed heap memory can be referenced during file handling. The root cause is a classic use-after-free memory safety flaw leading to heap corruption. An attacker can exploit this by convincing a local user to open or process a crafted malicious file in Chrome, triggering the vulnerable code path without elevated privileges. Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability, potentially including arbitrary code execution in the Chrome process or a reliable crash/DoS. 👉 Affected: Google Chrome < 150.0.7871.128 | Upgrade to 150.0.7871.128 or later
Post summary
Chrome’s Aura UI has a use‑after‑free heap corruption flaw that can be triggered by a crafted file; users should upgrade to 150.0.7871.128 or later to mitigate the vulnerability.
00000148
255 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds90d
Disclosure
CVE-2026-15905 Use After Free in Google Chrome Prior to 150.0.7871.128 Allows Heap Corruption https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15905
Post summary
A use‑after‑free vulnerability in Chrome before version 150.0.7871.128 that permits heap corruption is announced; no PoC, exploit, or patch details are included.
0000097
4.1K followersView on X
Infoflowcloud@infoflowcloud90d
Disclosure
🚨*CVE* CVE-2026-15905 Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium securi… https://www.cve.org/CVERecord?id=CVE-2026-15905 ----- Traducción: CVE-2026-15905 Uso… http://infoflow.cloud`
Post summary
CVE-2026-15905 reports a local use‑after‑free heap corruption in Chrome prior to 150.0.7871.128 via a malicious file, with no PoC, exploit, or active exploitation details provided.
0000037
93 followersView on X
CVE@CVEnew90d
Disclosure
CVE-2026-15905 Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium securi… https://www.cve.org/CVERecord?id=CVE-2026-15905
Post summary
CVE‑2026‑15905 is a use‑after‑free in Chrome’s Aura component that can let local attackers corrupt heap via malicious files; no PoC, exploit, patch, or active exploitation is indicated.
000001.2K
57.8K followersView on X
TECHEPAGES@techepages91d
Patch
🚨 🚨 Google's issued its 2nd critical Chrome update in just 48 hours (150.0.7871.128/.129). It patched 7 security vulnerabilities in the browser. 🔴 CVE-2026-15899 — UAF in CameraCapture 🔴 CVE-2026-15900 — UAF in GPU 🔴 CVE-2026-15901 — UAF in Network 🟠 CVE-2026-15902 — UAF in Cast 🟠 CVE-2026-15903 — OOB read/write in V8 (found by OpenAI Codex Security) 🟠 CVE-2026-15904 — UAF in Ozone 🟠 CVE-2026-15905 — UAF in Aura No active exploitation reported. Update now 🌐🔒
Post summary
Google released a critical Chrome update patching seven CVEs—including multiple use‑after‑free and an out‑of‑bounds read/write—while noting that no active exploitation has been reported.
0000065
29 followersView on X
VulDB 🛡@vuldb91d
Active Exploitation
Attention, elevated activities detected targeting Google Chrome (CVE-2026-15905) https://vuldb.com/vuln/380093/cti
Post summary
The message reports increased activity targeting Google Chrome via CVE-2026-15905, indicating the vulnerability is being actively exploited.
00000131
2.3K followersView on X
VulDB 🛡@vuldb92d
Disclosure
A severe vulnerability was disclosed for Google Chrome (CVE-2026-15905) https://vuldb.com/vuln/380093
Post summary
The post announces the discovery of CVE-2026-15905, a severe security flaw in Google Chrome, but provides no additional technical, exploit, or mitigation details.
00000169
2.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	chrome	-	-	-

Explore more

Back to dashboard google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-15905

Upwind Security MDR[verified]@UpwindMDRPatch

Chrome’s Aura UI has a use‑after‑free heap corruption flaw that can be triggered by a crafted file; users should upgrade to 150.0.7871.128 or later to mitigate the vulnerability.

TECHEPAGES[verified]@techepagesPatch

Google released a critical Chrome update patching seven CVEs—including multiple use‑after‑free and an out‑of‑bounds read/write—while noting that no active exploitation has been reported.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A use‑after‑free vulnerability in Chrome before version 150.0.7871.128 that permits heap corruption is announced; no PoC, exploit, or patch details are included.

Infoflowcloud@infoflowcloudDisclosure

CVE-2026-15905 reports a local use‑after‑free heap corruption in Chrome prior to 150.0.7871.128 via a malicious file, with no PoC, exploit, or active exploitation details provided.

CVE@CVEnewDisclosure

CVE‑2026‑15905 is a use‑after‑free in Chrome’s Aura component that can let local attackers corrupt heap via malicious files; no PoC, exploit, patch, or active exploitation is indicated.

VulDB 🛡@vuldbActive Exploitation

The message reports increased activity targeting Google Chrome via CVE-2026-15905, indicating the vulnerability is being actively exploited.

VulDB 🛡@vuldbDisclosure

The post announces the discovery of CVE-2026-15905, a severe security flaw in Google Chrome, but provides no additional technical, exploit, or mitigation details.