CVE-2026-15905 is a use-after-free vulnerability in the Aura subsystem of Google Chrome before version 150.0.7871.128. This vulnerability enables a local attacker to potentially exploit heap corruption by supplying a malicious file. The vulnerability was publicly disclosed and patched in Chrome version 150.0.7871.128. No CVSS score is provided, but the Chromium security team rates it as high severity. No known exploits in the wild have been reported at the time of disclosure.

Successful exploitation of this vulnerability could allow a local attacker to cause heap corruption, which may lead to arbitrary code execution or a denial of service. The impact is limited to local attackers who can provide a malicious file to the vulnerable Chrome instance.

Users should update Google Chrome to version 150.0.7871.128 or later, where this vulnerability is fixed. Since this is not a cloud service, remediation requires applying the official update from Google. Check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html for the latest update information.