Chrome Ozone use-after-free

Use-after-free in Chrome's Ozone platform-abstraction layer. A remote attacker who convinces a user to perform specific UI gestures could exploit heap corruption via a crafted HTML page. Fixed in Chrome 150.0.7871.125.

cat cve-2026-15765.json

Vendor: Google
Product: Chrome (pre-150.0.7871.125)
CVSS: 7.5
EPSS (exploit probability): N/A
Status: patched
Published: July 14, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-15765

CVE-2026-15765 is a use-after-free in Chromium’s Ozone platform-abstraction layer. NVD describes it as “a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.” NVD scores it 7.5 (high); Chromium’s internal severity is marked Critical.

The fix ships in Chrome 150.0.7871.125 (Windows and macOS 150.0.7871.124 or .125 per Chrome release notes). Sibling bug on Linux: CVE-2026-15764.

Full coverage: Firefox exploit code public; Chrome, Adobe patch same day.

Related coverage

~/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day

mozilla

Firefox exploit code public; Chrome, Adobe patch same day

Mozilla says exploit code is public for two Firefox flaws fixed in 152.0.6. Chrome shipped Ozone use-after-free fixes; Adobe pushed 8 ColdFusion criticals.

Jul 15 read →