CVE-2026-15900 Overview
CVE-2026-15900 is a use-after-free vulnerability in the GPU component of Google Chrome on Android. The flaw affects Chrome versions prior to 150.0.7871.128 and allows a remote attacker to potentially escape the browser sandbox through a crafted HTML page. Chromium classifies the severity as Critical.
Exploitation requires user interaction, such as visiting a malicious website. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected mobile device. The vulnerability is tracked under CWE-416.
Critical Impact
A remote attacker can trigger memory corruption in the Chrome GPU process via a crafted web page, enabling a sandbox escape on Android devices.
Affected Products
- Google Chrome on Android prior to 150.0.7871.128
- Chromium-based browsers on Android sharing the same GPU code path
- Android devices running vulnerable Chrome builds
Discovery Timeline
- 2026-07-20 - CVE-2026-15900 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-15900
Vulnerability Analysis
CVE-2026-15900 is a use-after-free (UAF) condition inside the GPU process of Chrome on Android. UAF vulnerabilities occur when memory is freed but a dangling reference to that memory continues to be used. An attacker who controls the freed region can influence subsequent operations that dereference the stale pointer.
The GPU process in Chrome handles graphics command buffers, texture allocation, and compositor operations. Because it interacts directly with device drivers, a memory corruption bug here provides a strong primitive for escaping the renderer sandbox. Chromium rated this issue Critical, reflecting the sandbox escape potential.
On Android, a successful GPU-process compromise gives the attacker execution outside the renderer sandbox with access to shared memory, GPU drivers, and inter-process channels. This can be chained with a kernel or driver flaw for full device compromise.
Root Cause
The root cause is improper lifetime management of an object in the GPU component. A pointer or handle referencing the freed object is reused during subsequent GPU command processing, which corresponds to CWE-416: Use After Free. Google has not published detailed root-cause information at time of writing.
Attack Vector
Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page that issues specific WebGL, WebGPU, or canvas operations designed to trigger the freed-then-reused condition inside the GPU process. Any vector that renders attacker-controlled HTML — direct navigation, iframes, ads, or in-app browser components — can serve as the delivery mechanism.
See the Chromium Issue Tracker #523750584 and the Google Chrome Desktop Update advisory for vendor references. No public proof-of-concept exploit is currently available.
Detection Methods for CVE-2026-15900
Indicators of Compromise
- Android Chrome processes crashing repeatedly with GPU-process termination signals shortly after visiting external URLs.
- Unexpected child process spawning from com.android.chrome or Chromium-based mobile app packages.
- Outbound connections from mobile devices to previously unseen domains immediately following browser activity.
Detection Strategies
- Inventory installed Chrome versions on managed Android devices and flag any build below 150.0.7871.128.
- Monitor mobile device management (MDM) telemetry for browser crash reports referencing the GPU process.
- Correlate web proxy logs with browser crashes to identify potentially malicious pages triggering GPU faults.
Monitoring Recommendations
- Enable Chrome crash reporting through enterprise policy to collect GPU-process crash dumps for triage.
- Ingest mobile browser telemetry and web gateway logs into a centralized data lake for correlation across users.
- Track newly registered or low-reputation domains delivering HTML with heavy WebGL or WebGPU payloads.
How to Mitigate CVE-2026-15900
Immediate Actions Required
- Update Google Chrome on all Android devices to version 150.0.7871.128 or later through the Google Play Store or enterprise MDM.
- Push a mandatory Chrome update policy via Android Enterprise or your MDM platform to enforce compliance.
- Advise users to avoid untrusted links and to close and reopen Chrome after updating to ensure the patched binary is active.
Patch Information
Google addressed CVE-2026-15900 in Chrome 150.0.7871.128 and later on the Android channel. Refer to the Google Chrome Stable Channel Update for the vendor release announcement and to Chromium Issue Tracker #523750584 for the tracked issue.
Workarounds
- Restrict browsing to trusted sites via mobile web filtering until patches are deployed across the fleet.
- Disable hardware acceleration in Chrome flags where feasible to reduce exposure of GPU-process code paths, accepting the performance impact.
- Use MDM controls to block installation or execution of outdated Chrome versions on corporate Android devices.
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should reflect 150.0.7871.128 or later
# versionName=150.0.7871.128
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
