CVE-2026-15764
published 2026-07-14CVE-2026-15764: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
PriorityP345high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.48%
39.0th percentile
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 150.0.7871.125 | 150.0.7871.125 | |
| chrome | >= 150.0.7871.125 < 150.0.7871.125 | 150.0.7871.125 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: chromium-browser: Use after free in Ozone
vendor_redhat·2026-07-14·CVSS 7.5
CVE-2026-15764 [HIGH] CWE-825 chromium-browser: chromium-browser: Use after free in Ozone
chromium-browser: chromium-browser: Use after free in Ozone
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
An use after free flaw was found in the Ozone component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=517100492
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-15764
vendor_chrome·2026-07-14·CVSS 7.5
CVE-2026-15764 [CRITICAL] Stable Channel Update for Desktop: CVE-2026-15764
Stable Channel Update for Desktop
CVE-2026-15764: Use after free in Ozone. Reported by Google on 2026-05-27 [N/A][ 518007484 ] Critical CVE-2026-15765: Use after free in Ozone
Reported by Google on 2026-05-29 [N/A][ 514010477 ] High CVE-2026-15766: Uninitialized Use in Skia
Severity: critical
GHSA
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a
ghsa_unreviewed·2026-07-14
CVE-2026-15764 [HIGH] CWE-416 Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
No detection rules found.
No public exploits indexed.
Hackernews
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
blogs_hackernews·2026-07-15·CVSS 4.3
CVE-2026-15718 [MEDIUM] Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published.
The vulnerabilities are listed below -
CVE-2026-15718 , an invalid pointer in the JavaScript: WebAssembly component
CVE-2026-15719 , a site isolation in the DOM: Navigation component
"We are aware that exploit code for this is public, however we are not aware of any attacks in the wild abusing this flaw," Mozilla said in an advisory. Both vulnerabilities have been addressed in Firefox version 152.0.6.
The release com
Bugzilla
CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2
bugzilla·2026-07-22·CVSS 7.5
CVE-2026-15764 [HIGH] CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2
CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2026-15777 ... chromium: various flaws [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin
Bugzilla
CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2
bugzilla·2026-07-22·CVSS 7.5
CVE-2026-15764 [HIGH] CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2
CVE-2026-15764 CVE-2026-15765 CVE-2026-15766 CVE-2026-15767 CVE-2026-15768 CVE-2026-15769 CVE-2026-15770 CVE-2026-15771 CVE-2026-15772 CVE-2026-15773 CVE-2026-15774 CVE-2026-15775 CVE-2026-15776 CVE-2026-15777 ... chromium: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same orig
Bugzilla
CVE-2026-15764 chromium-browser: chromium-browser: Use after free in Ozone
bugzilla·2026-07-14·CVSS 7.5
CVE-2026-15764 [HIGH] CVE-2026-15764 chromium-browser: chromium-browser: Use after free in Ozone
CVE-2026-15764 chromium-browser: chromium-browser: Use after free in Ozone
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
2026-07-14
Published