Skip to content
feed: live
0dayNews
CVE Record
[ HIGH ]CVE-2026-15765

Chrome Ozone use-after-free

Use-after-free in Chrome's Ozone platform-abstraction layer. A remote attacker who convinces a user to perform specific UI gestures could exploit heap corruption via a crafted HTML page. Fixed in Chrome 150.0.7871.125.

cat cve-2026-15765.json
Vendor
Google
Product
Chrome (pre-150.0.7871.125)
CVSS
7.5
EPSS (exploit probability)
0.5%
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-15765

Is CVE-2026-15765 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-15765 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).

Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison

CVE-2026-15765 is a use-after-free in Chromium’s Ozone platform-abstraction layer. NVD describes it as “a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.” NVD scores it 7.5 (high); Chromium’s internal severity is marked Critical.

The fix ships in Chrome 150.0.7871.125 (Windows and macOS 150.0.7871.124 or .125 per Chrome release notes). Sibling bug on Linux: CVE-2026-15764.

Full coverage: Firefox exploit code public; Chrome, Adobe patch same day.

Other Google Chrome CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-106382
Use-after-free in Chromecast allows sandbox code executionwrite-up
[ CRITICAL ]9.60.4%—
CVE-2026-106358
Use-after-free in Chrome Navigation allows sandbox code executionwrite-up
[ CRITICAL ]9.60.5%—
CVE-2026-106347
Use-after-free in Chrome Track component allows sandbox code executionwrite-up
[ HIGH ]8.80.4%—
CVE-2026-106197
Use-after-free in Chrome Browser component enables sandbox RCEwrite-up
[ CRITICAL ]9.60.5%—
CVE-2026-85046
Type confusion in Chrome V8 allows sandbox code executionwrite-up
[ HIGH ]8.848.9%
CVE-2020-16017
Google Chrome Use-After-Free Vulnerability
[ CRITICAL ]9.62.7%
All 7 Google Chrome known exploited vulnerabilities →
Related coverage
~/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day
mozilla

Firefox exploit code public; Chrome, Adobe patch same day

Mozilla says exploit code is public for two Firefox flaws fixed in 152.0.6. Chrome shipped Ozone use-after-free fixes; Adobe pushed 8 ColdFusion criticals.

read →