Multiple Vulnerabilities in Google Chrome Enable Remote Code Execution and Information Disclosure (CVE-2026-15899 through CVE-2026-15905)

Multiple Vulnerabilities in Google Chrome Enable Remote Code (TL-2026-1501), also tracked as Chrome 150 Stable Channel Security Update, is a high-severity software vulnerability, first published 2026-07-18. It has no confirmed attribution, affects Google Chrome (Windows), references 7 CVEs (CVE-2026-15899, CVE-2026-15900, CVE-2026-15901), maps to 20 MITRE ATT&CK techniques (T1005, T1055, T1068), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1501

Threat ID
TL-2026-1501
Also known as
Chrome 150 Stable Channel Security Update, GovCERT.HK Alert A26-07-31, CERTFR-2026-AVI-0897, HKCERT Google Chrome Multiple Vulnerabilities Bulletin (2026-07-17)
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-18
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all sectors general chrome user base, government administration, enterprise, critical-infrastructure, education, health, finance
Target regions
Global, hong kong, france
Detection rules
9
Indicators of compromise
22

Google shipped Chrome 150.0.7871.128/.129 for Windows/Mac and 150.0.7871.128 for Linux on 2026-07-16, patching seven vulnerabilities (three Critical, four High) spanning CameraCapture, GPU, Network, Cast, V8, Ozone, and Aura. GovCERT.HK issued Security Alert A26-07-31 the next day warning that a remote attacker could entice a victim to open a specially crafted web page to trigger remote code execution or information disclosure.

How Multiple Vulnerabilities in Google Chrome Enable Remote Code works

On 2026-07-16 the Google Chrome team published a stable channel update raising the desktop release to version 150.0.7871.128 (Windows/Mac also received a parallel 150.0.7871.129 build) and 150.0.7871.128 for Linux, rolling out over subsequent days/weeks via Chrome's auto-update mechanism. The release addresses seven vulnerabilities tracked as CVE-2026-15899 through CVE-2026-15905, three of which Google rates Critical and four of which are rated High. The three Critical issues are use-after-free (UAF) memory-corruption bugs in the CameraCapture subsystem (CVE-2026-15899, reported internally 2026-05-27), the GPU process (CVE-2026-15900, reported internally 2026-06-14 — the GPU process manages hardware-accelerated compositing, WebGL, video decode, and canvas rendering, making it reachable from ordinary web content), and the Network stack (CVE-2026-15901, reported to Google 2026-07-10) — all classes of bug that historically underpin renderer or GPU-process remote code execution chains reachable from a single malicious web page, frequently combined with a second bug (sandbox escape or type confusion) for full system compromise. The four High-severity issues comprise a use-after-free in Cast (CVE-2026-15902, reported 2026-06-10), an out-of-bounds read AND write flaw in the V8 JavaScript engine (CVE-2026-15903, reported by external researcher 'amyb' of OpenAI Codex Security on 2026-07-06 — an OOB read/write primitive in V8 is a classic building block for constructing an arbitrary read/write capability inside the renderer sandbox), an issue in the Ozone platform abstraction layer used by Linux/ChromeOS builds (CVE-2026-15904), and a use-after-free in Aura, the cross-platform windowing/compositing system (CVE-2026-15905). GovCERT.HK (Hong Kong Government Computer Emergency Response Team) issued Security Alert A26-07-31 on 2026-07-17, characterizing overall severity as High and warning that "a remote attacker could entice a user to open a web page with specially crafted content" to trigger RCE or information disclosure — the classic Chrome drive-by exploitation pattern: victim navigation/click is the only user interaction required, no attachment or download involved. HKCERT published a parallel bulletin the same day, and France's CERT-FR (ANSSI) issued advisory CERTFR-2026-AVI-0897 on 2026-07-17 covering the identical CVE set, indicating multi-national government CERT coordination/dissemination of this advisory within 24 hours of the vendor patch. As of this research (2026-07-18) neither the CISA Known Exploited Vulnerabilities (KEV) catalog nor Google's own advisory language indicate confirmed in-the-wild exploitation; Google's release notes for this cycle do not carry Google's standalone "exploit exists in the wild" caveat that accompanies actively-exploited 0-days, and none of CVE-2026-15899 through CVE-2026-15905 appear in the CISA KEV feed as of the alert date. Consistent with Google's standard disclosure practice, technical bug-tracker details for all seven CVEs remain access-restricted until a majority of the Chrome user base has installed the fix, to slow adversary reverse-engineering of a working exploit from the patch diff (a well-documented Chrome n-day risk window). Exploitability is therefore assessed as POC_PUBLIC/plausible-but-unconfirmed rather than confirmed active exploitation, and the advisory should be treated as a preventive high-priority patch rather than an active-incident notification. Because most of the fixed classes are use-after-free bugs, the standard Chrome UAF exploitation chain applies: an attacker-controlled web page triggers a dangling-pointer condition in the vulnerable component (CameraCapture, GPU, Cast, Aura), reclaims the freed memory with attacker-controlled data via heap grooming/spraying (JS typed arrays, ArrayBuffers, or WebGL/Canvas objects), and pivots the corrupted vtable/object state into arbitrary read/write and ultimately code execution inside the renderer or GPU process; the V8 OOB read/write bug (CVE-2026-15903) or the Network-stack UAF (CVE-2026-15901) could plausibly be chained with one of the other six bugs to gain a stronger memory-corruption primitive or attempt a full sandbox escape, following the well-established two-bug Chrome exploit-chain pattern (renderer/engine bug + sandbox-escape bug). No PoC code, exploit chain writeup, or malware family associated with these specific CVEs has been publicly disclosed as of 2026-07-18; all technical characterization here is inferred from the documented bug classes/components per Google's, GovCERT.HK's, HKCERT's, CERT-FR's, and third-party outlet reporting of the release, consistent with well-established patterns for this bug family in prior Chrome advisories.

MITRE ATT&CK techniques used in TL-2026-1501

Collection

T1005 Data from Local System; T1125 Video Capture; T1185 Browser Session Hijacking

Defense Evasion

T1055 Process Injection; T1211 Exploitation for Stealth

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Persistence

T1176 Software Extensions

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Execution

T1203 Exploitation for Client Execution

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Resource Development

T1584 Compromise Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1593 Search Open Websites/Domains

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Multiple Vulnerabilities in Google Chrome Enable Remote Code

  • Google — Chrome (Windows)
    Vulnerable versions: prior to 150.0.7871.128
    Fixed in: 150.0.7871.128; 150.0.7871.129
  • Google — Chrome (Mac)
    Vulnerable versions: prior to 150.0.7871.128
    Fixed in: 150.0.7871.128; 150.0.7871.129
  • Google — Chrome (Linux)
    Vulnerable versions: prior to 150.0.7871.128
    Fixed in: 150.0.7871.128

Remediation for Multiple Vulnerabilities in Google Chrome Enable Remote Code

Patches

  • Google Chrome 150.0.7871.128 (Linux)
  • Google Chrome 150.0.7871.128/150.0.7871.129 (Windows, Mac)

Immediate actions

  • Update Google Chrome to version 150.0.7871.128 (Linux) or 150.0.7871.128/.129 (Windows, Mac) or later via chrome://settings/help or the built-in auto-updater
  • Restart the browser after update to load the patched binary — an update download alone does not apply the fix until relaunch
  • For managed/enterprise fleets, force-push the Chrome policy update via Google Admin Console / Chrome Browser Cloud Management or WSUS/Intune to accelerate rollout ahead of the staged auto-update window
  • Audit and patch any Chromium-based derivative browsers (Microsoft Edge, Brave, Opera, Vivaldi) for equivalent upstream fixes, as Chromium CVEs typically propagate to downstream browsers within days
  • Verify deployed version strings across the fleet (chrome://version or MDM inventory) to confirm 150.0.7871.128+ is actually installed, not merely downloaded and pending relaunch

Workarounds

  • No effective workaround short of patching — these are memory-corruption bugs reachable by simply loading a crafted page; disabling JavaScript site-wide is the only partial mitigation and is not practical for general browsing

Longer-term hardening

  • Enforce Chrome/Chromium auto-update policies (do not disable browser auto-update in enterprise images)
  • Deploy endpoint detection with browser-process (renderer/GPU process) crash and anomalous child-process monitoring to catch post-exploitation behavior from UAF-class browser bugs
  • Maintain Site Isolation and enable strict sandboxing policies (chrome://sandbox) fleet-wide
  • Track Chrome release notes and CISA/GovCERT/HKCERT/CERT-FR advisories on a recurring cadence given the near-monthly cadence of Chrome security releases
  • Subscribe to multiple national CERT feeds (GovCERT.HK, HKCERT, CERT-FR/ANSSI) for redundant early-warning coverage of Chromium advisories

CVEs associated with Multiple Vulnerabilities in Google Chrome Enable Remote Code

CVE-2026-15899, CVE-2026-15900, CVE-2026-15901, CVE-2026-15902, CVE-2026-15903, CVE-2026-15904, CVE-2026-15905

Weaknesses (CWE) in Multiple Vulnerabilities in Google Chrome Enable Remote Code

CWE-416, CWE-843, CWE-125, CWE-787

Timeline of Multiple Vulnerabilities in Google Chrome Enable Remote Code

  • CVE-2026-15899, a Critical use-after-free in Chrome's CameraCapture component, is reported to Google's internal security team.
  • CVE-2026-15902, a High-severity use-after-free in the Cast component, is reported to Google.
  • CVE-2026-15900, a Critical use-after-free in Chrome's GPU process, is reported internally to Google's security team.
  • CVE-2026-15903, a High-severity out-of-bounds read/write in the V8 JavaScript engine, is reported to Google by external researcher 'amyb' of OpenAI Codex Security.
  • CVE-2026-15901, a Critical use-after-free in Chrome's Network stack, is reported to Google.
  • Google security engineering finalizes internal patches for the CameraCapture, GPU, Network, Cast, V8, Ozone, and Aura fixes ahead of the stable release.
  • Google publishes the Stable Channel Update for Desktop, shipping Chrome 150.0.7871.128/.129 (Windows/Mac) and 150.0.7871.128 (Linux), fixing seven CVEs including three Critical and four High severity issues.
  • Neowin, WindowsNews.ai, and other outlets report on the Chrome 150 update, detailing the three Critical (CameraCapture, GPU, Network) and High-severity (Cast, V8, Ozone, Aura) fixes, and noting that most CVE technical details remain restricted pending broader patch adoption.
  • France's CERT-FR (ANSSI) publishes advisory CERTFR-2026-AVI-0897 covering the identical CVE-2026-15899 through CVE-2026-15905 set, evidencing coordinated multi-national CERT dissemination within 24 hours of the vendor patch.
  • HKCERT publishes a parallel security bulletin covering the same Chrome 150 vulnerability set.
  • GovCERT.HK issues Security Alert A26-07-31, rating overall severity High and warning of RCE/information-disclosure risk from crafted web pages.
  • Threat added to TL-Intel backlog via GovCERT.HK RSS ingestion and promoted through the HUNT phase for full research.
  • CISA Known Exploited Vulnerabilities catalog checked; none of CVE-2026-15899 through CVE-2026-15905 present, indicating no confirmed active exploitation as of this date.
  • Forbes reports on the Chrome update as part of coverage on Google's back-to-back critical Chrome security releases within a 48-hour window.

Sources cited for Multiple Vulnerabilities in Google Chrome Enable Remote Code

Threats related to Multiple Vulnerabilities in Google Chrome Enable Remote Code

Detection coverage for TL-2026-1501

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1501 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats