CVE-2026-15120 is a use-after-free vulnerability in the Core of Google Chrome on Windows versions before 150.0.7871.115. Exploiting this vulnerability requires that the attacker has already compromised the renderer process. Successful exploitation could lead to a sandbox escape, allowing the attacker to execute code with higher privileges than normally permitted within the browser sandbox. The vulnerability is rated high severity with a CVSS 3.1 score of 8.3, reflecting its potential impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow an attacker to escape the Chrome sandbox, potentially leading to arbitrary code execution on the host system with elevated privileges. This could compromise the confidentiality, integrity, and availability of the affected system. However, exploitation requires prior compromise of the renderer process and user interaction (UI required).

Google has released a stable channel update for Chrome version 150.0.7871.115 that addresses this vulnerability. Users and administrators should update to version 150.0.7871.115 or later to remediate this issue. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. No additional mitigations are specified by the vendor.