CVE-2026-15902 is a use-after-free vulnerability in the Cast feature of Google Chrome versions before 150.0.7871.128. Exploitation requires user interaction via a maliciously crafted HTML page, enabling remote code execution inside the sandbox environment. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8, reflecting its network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. The vendor has published an advisory indicating the fixed version 150.0.7871.128, but explicit patch or remediation details are not stated in the input data.

Successful exploitation allows remote attackers to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction but no privileges or authentication, making it a significant risk for users running vulnerable versions.

Users should update Google Chrome to version 150.0.7871.128 or later to remediate this vulnerability. The vendor advisory linked confirms the availability of a fixed version. No additional mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory indicating the fixed version.