CVE-2026-15767 is a heap buffer overflow vulnerability in the libyuv library used by Google Chrome on Windows platforms. Versions of Chrome before 150.0.7871.125 are affected. Exploitation involves a remote attacker delivering a crafted video file that triggers the overflow, enabling arbitrary code execution inside the sandbox environment. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, indicating network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has published a stable channel update addressing this issue.

Successful exploitation allows remote attackers to execute arbitrary code within the sandbox of Google Chrome on Windows, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions or control over the browser environment.

Users should update Google Chrome on Windows to version 150.0.7871.125 or later, where this vulnerability is fixed. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html provides the official update. No other mitigations are indicated by the vendor.