CVE-2026-15902 is a use-after-free vulnerability in the Cast feature of Google Chrome that affects versions prior to 150.0.7871.128. Exploitation requires a remote attacker to serve a specially crafted HTML page, enabling arbitrary code execution inside the browser's sandbox environment. The vulnerability is recognized as high severity by Chromium security. The vendor has published a stable channel update addressing this issue in version 150.0.7871.128. No CVSS score is provided. No known exploits in the wild have been reported at this time.

Successful exploitation allows remote code execution within the sandboxed environment of Google Chrome, potentially compromising the affected system's security. The vulnerability could enable an attacker to run arbitrary code remotely via a crafted HTML page. However, no known exploits have been reported in the wild.

A fixed version of Google Chrome is available at 150.0.7871.128. Users and administrators should update to this version or later to remediate the vulnerability. Patch status is confirmed by the vendor's stable channel update advisory. No additional mitigation steps are specified by the vendor.