CVE-2026-15903: Google Chrome V8 RCE Vulnerability

CVE-2026-15903 Overview

CVE-2026-15903 is an out-of-bounds read and write vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.128 and allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. Chromium's security team rated the underlying issue as High severity. Exploitation requires user interaction, typically loading a malicious web page. Successful exploitation yields code execution constrained to Chrome's renderer sandbox, though such flaws are frequently chained with sandbox escapes to achieve full compromise.

Critical Impact
Remote attackers can execute arbitrary code in the Chrome renderer process by tricking a user into visiting a crafted HTML page.

Affected Products

Google Chrome desktop versions prior to 150.0.7871.128
Chromium-based browsers embedding the affected V8 engine
All operating system builds (Windows, macOS, Linux) shipping vulnerable Chrome versions

Discovery Timeline

2026-07-20 - CVE CVE-2026-15903 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15903

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 compiles and executes untrusted JavaScript from any page a user visits, making it a persistent target for exploit developers. An out-of-bounds read and write condition permits code running inside V8 to access memory outside the bounds of an intended buffer or object.

When an attacker triggers the flaw from JavaScript, they can read adjacent heap memory and corrupt neighboring objects. This class of primitive is typically converted into arbitrary read/write, then into code execution inside the renderer process. Because the renderer runs in a sandbox, successful exploitation yields attacker-controlled code within that sandbox rather than immediate system compromise.

Root Cause

The root cause is improper bounds validation within V8's object or buffer handling code paths [CWE-125, CWE-787]. Specific technical details have not been disclosed publicly. Google restricts access to Chromium bug reports until the majority of users have received the fix, which is standard practice for browser vulnerabilities under active patching.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page containing malicious JavaScript that exercises the vulnerable V8 code path. When a user navigates to the page using an unpatched Chrome build, V8 processes the payload and the out-of-bounds condition is triggered. Delivery mechanisms include phishing links, malicious advertising, watering-hole attacks, and compromised legitimate sites.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement once details are released.

Detection Methods for CVE-2026-15903

Indicators of Compromise

Unexpected Chrome renderer process crashes with SIGSEGV or access violation signatures preceding suspicious child process activity
Chrome processes spawning shells, scripting hosts, or other unusual child processes shortly after page navigation
Outbound network connections from renderer processes to previously unseen infrastructure

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.128
Monitor process trees where chrome.exe or the Chrome helper renderer spawns non-standard child processes
Correlate browser crash telemetry with subsequent process execution or network anomalies to surface exploitation attempts

Monitoring Recommendations

Ingest browser version telemetry into your SIEM and alert on hosts running vulnerable Chrome builds
Enable web proxy logging with URL and content-type inspection to identify delivery of malicious HTML payloads
Track EDR telemetry for renderer sandbox anomalies, including unexpected memory allocations and thread injection patterns

How to Mitigate CVE-2026-15903

Immediate Actions Required

Update Google Chrome to version 150.0.7871.128 or later on all managed endpoints
Restart Chrome after updating; the patch does not take effect until the browser process is restarted
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates as they ship the corresponding V8 fix

Patch Information

Google released the fix in Chrome Stable channel version 150.0.7871.128. Deployment details are documented in the Google Chrome Update Announcement. Enterprises using Chrome Browser Cloud Management or group policy should force the update rather than relying on user-initiated restarts.

Workarounds

Restrict browsing to trusted sites via allowlisting where operational requirements permit until patching completes
Disable JavaScript for untrusted origins using Chrome enterprise policies such as DefaultJavaScriptSetting
Deploy site isolation and enforce --site-per-process to reduce cross-origin exploitation impact

bash

# Chrome enterprise policy example (Linux JSON policy) to restrict JavaScript
# Place in /etc/opt/chrome/policies/managed/javascript-restrict.json
{
  "DefaultJavaScriptSetting": 2,
  "JavaScriptAllowedForUrls": [
    "https://[*.]corp.example.com",
    "https://[*.]trusted-saas.com"
  ],
  "TargetBlankImpliesNoOpener": true
}