# Multiple Vulnerabilities in Google Chrome Enable Remote Code Execution and Information Disclosure (CVE-2026-15899 through CVE-2026-15905)

> Google shipped Chrome 150.0.7871.128/.129 for Windows/Mac and 150.0.7871.128 for Linux on 2026-07-16, patching seven vulnerabilities (three Critical, four High) spanning CameraCapture, GPU, Network, Cast, V8, Ozone, and Aura. GovCERT.HK issued Security Alert A26-07-31 the next day warning that a remote attacker could entice a victim to open a specially crafted web page to trigger remote code execution or information disclosure.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1501
- **ID:** TL-2026-1501
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15899, CVE-2026-15900, CVE-2026-15901, CVE-2026-15902, CVE-2026-15903, CVE-2026-15904, CVE-2026-15905

## Description

On 2026-07-16 the Google Chrome team published a stable channel update raising the desktop release to version 150.0.7871.128 (Windows/Mac also received a parallel 150.0.7871.129 build) and 150.0.7871.128 for Linux, rolling out over subsequent days/weeks via Chrome's auto-update mechanism. The release addresses seven vulnerabilities tracked as CVE-2026-15899 through CVE-2026-15905, three of which Google rates Critical and four of which are rated High. The three Critical issues are use-after-free (UAF) memory-corruption bugs in the CameraCapture subsystem (CVE-2026-15899, reported internally 2026-05-27), the GPU process (CVE-2026-15900, reported internally 2026-06-14 — the GPU process manages hardware-accelerated compositing, WebGL, video decode, and canvas rendering, making it reachable from ordinary web content), and the Network stack (CVE-2026-15901, reported to Google 2026-07-10) — all classes of bug that historically underpin renderer or GPU-process remote code execution chains reachable from a single malicious web page, frequently combined with a second bug (sandbox escape or type confusion) for full system compromise. The four High-severity issues comprise a use-after-free in Cast (CVE-2026-15902, reported 2026-06-10), an out-of-bounds read AND write flaw in the V8 JavaScript engine (CVE-2026-15903, reported by external researcher 'amyb' of OpenAI Codex Security on 2026-07-06 — an OOB read/write primitive in V8 is a classic building block for constructing an arbitrary read/write capability inside the renderer sandbox), an issue in the Ozone platform abstraction layer used by Linux/ChromeOS builds (CVE-2026-15904), and a use-after-free in Aura, the cross-platform windowing/compositing system (CVE-2026-15905). GovCERT.HK (Hong Kong Government Computer Emergency Response Team) issued Security Alert A26-07-31 on 2026-07-17, characterizing overall severity as High and warning that "a remote attacker could entice a user to open a web page with specially crafted content" to trigger RCE or information disclosure — the classic Chrome drive-by exploitation pattern: victim navigation/click is the only user interaction required, no attachment or download involved. HKCERT published a parallel bulletin the same day, and France's CERT-FR (ANSSI) issued advisory CERTFR-2026-AVI-0897 on 2026-07-17 covering the identical CVE set, indicating multi-national government CERT coordination/dissemination of this advisory within 24 hours of the vendor patch. As of this research (2026-07-18) neither the CISA Known Exploited Vulnerabilities (KEV) catalog nor Google's own advisory language indicate confirmed in-the-wild exploitation; Google's release notes for this cycle do not carry Google's standalone "exploit exists in the wild" caveat that accompanies actively-exploited 0-days, and none of CVE-2026-15899 through CVE-2026-15905 appear in the CISA KEV feed as of the alert date. Consistent with Google's standard disclosure practice, technical bug-tracker details for all seven CVEs remain access-restricted until a majority of the Chrome user base has installed the fix, to slow adversary reverse-engineering of a working exploit from the patch diff (a well-documented Chrome n-day risk window). Exploitability is therefore assessed as POC_PUBLIC/plausible-but-unconfirmed rather than confirmed active exploitation, and the advisory should be treated as a preventive high-priority patch rather than an active-incident notification. Because most of the fixed classes are use-after-free bugs, the standard Chrome UAF exploitation chain applies: an attacker-controlled web page triggers a dangling-pointer condition in the vulnerable component (CameraCapture, GPU, Cast, Aura), reclaims the freed memory with attacker-controlled data via heap grooming/spraying (JS typed arrays, ArrayBuffers, or WebGL/Canvas objects), and pivots the corrupted vtable/object state into arbitrary read/write and ultimately code execution inside the renderer or GPU process; the V8 OOB read/write bug (CVE-2026-15903) or the Network-stack UAF (CVE-2026-15901) could plausibly be chained with one of the other six bugs to gain a stronger memory-corruption primitive or attempt a full sandbox escape, following the well-established two-bug Chrome exploit-chain pattern (renderer/engine bug + sandbox-escape bug). No PoC code, exploit chain writeup, or malware family associated with these specific CVEs has been publicly disclosed as of 2026-07-18; all technical characterization here is inferred from the documented bug classes/components per Google's, GovCERT.HK's, HKCERT's, CERT-FR's, and third-party outlet reporting of the release, consistent with well-established patterns for this bug family in prior Chrome advisories.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1584 Compromise Infrastructure
- T1189 Drive-by Compromise
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1176 Software Extensions
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1518 Software Discovery
- T1125 Video Capture
- T1185 Browser Session Hijacking
- T1005 Data from Local System
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1071 Application Layer Protocol

## Sources

- [Security Alert A26-07-31: Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=1971)
- [Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html)
- [Google Chrome Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260717)
- [Multiples vulnérabilités dans Google Chrome (CERTFR-2026-AVI-0897)](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0897)
- [Latest Google Chrome update fixes 7 vulnerabilities, including 3 critical ones](https://www.neowin.net/news/latest-google-chrome-update-fixes-7-vulnerabilities-including-3-critical-ones/)
- [Google Chrome 150 Update Fixes High-Severity Cast Vulnerability — What Windows Users Need to Know](https://windowsnews.ai/article/google-chrome-150-update-fixes-high-severity-cast-vulnerability-what-windows-users-need-to-know.439091)
- [Critical Chrome GPU Flaw Fixed in Latest Update — Why Windows Users Can't Wait for the NVD to Catch Up](https://windowsnews.ai/article/critical-chrome-gpu-flaw-fixed-in-latest-update-why-windows-users-cant-wait-for-the-nvd-to-catch-up.439089)
- [CVE-2026-15899: Why Chrome's Latest Security Fix Is Invisible to the NVD — and How to Respond](https://windowsnews.ai/article/cve-2026-15899-why-chromes-latest-security-fix-is-invisible-to-the-nvd-and-how-to-respond.439088)
- [That Alarming New Chromium CVE Is Real, But the Details Are Still a Mystery (CVE-2026-15903)](https://windowsnews.ai/article/that-alarming-new-chromium-cve-is-real-but-the-details-are-still-a-mystery.439087)
- [Google Confirms 2nd Critical Chrome Security Update Within 48 Hours](https://www.forbes.com/sites/daveywinder/2026/07/18/google-confirms-2nd-critical-chrome-security-update-within-48-hours/)
- [Google Chrome for Linux Download - 150.0.7871.128](https://www.techspot.com/downloads/4909-google-chrome-for-linux.html)
- [CISA Known Exploited Vulnerabilities Catalog (checked, no CVE-2026-15899..15905 entries as of alert date)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1501