CVE-2026-15113: Google Chrome Use-After-Free Vulnerability

CVE-2026-15113 Overview

CVE-2026-15113 is a use-after-free vulnerability in the Autofill component of Google Chrome on Android. The flaw affects versions prior to 150.0.7871.115 and allows a remote attacker to potentially achieve a sandbox escape through a crafted HTML page. Chromium classifies the security severity as High, and the CVSS 3.1 base score is 9.6.

Exploitation requires the victim to load attacker-controlled web content in the mobile browser. A successful sandbox escape breaks the isolation boundary that separates renderer processes from the rest of the Android system.

Critical Impact
Attackers can trigger memory corruption in Chrome's Autofill code path and escape the browser sandbox from a single crafted web page.

Affected Products

Google Chrome on Android prior to 150.0.7871.115
Chromium-based browsers on Android that inherit the vulnerable Autofill code
Android WebView components dependent on the affected Chromium release

Discovery Timeline

2026-07-08 - CVE-2026-15113 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15113

Vulnerability Analysis

CVE-2026-15113 is a use-after-free defect [CWE-416] in the Autofill subsystem of Chrome on Android. Autofill manages suggestions and form-field data as users interact with input elements on a page. A crafted HTML page can manipulate the lifecycle of Autofill objects so that memory is freed while a dangling reference remains reachable.

When the freed object is accessed later, the attacker controls the contents of the reclaimed allocation. This primitive can be shaped into type confusion or arbitrary read/write inside the affected process. Chromium's advisory indicates the flaw is usable as part of a sandbox escape chain rather than a pure renderer compromise.

User interaction is required, consistent with the browsing model. The attack traverses the network, does not require prior authentication, and can change the security scope of the compromised process.

Root Cause

The root cause is improper object lifetime management in Autofill. A reference to an Autofill data structure survives after the underlying allocation is released, producing a dangling pointer. Subsequent operations dereference that pointer and operate on attacker-influenced memory. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

An attacker hosts a crafted HTML page that exercises Autofill flows, such as focusing form fields, dispatching input events, and navigating in ways that trigger destruction of specific Autofill objects. The page then re-enters code paths that reuse the freed object. Delivery vectors include phishing links, malvertising, and compromised third-party content embedded via iframes.

No verified proof-of-concept has been published. Refer to the Google Blog Chrome Update for the vendor statement.

Detection Methods for CVE-2026-15113

Indicators of Compromise

Chrome for Android processes crashing in Autofill-related stack frames on mobile endpoints
Outbound connections from mobile devices to newly registered domains hosting form-heavy HTML content
Unexpected child processes or native library loads spawned by the Chrome package after browsing sessions
Android system logs showing SIGSEGV or abort signals in com.android.chrome following page navigation

Detection Strategies

Inventory Chrome versions across managed Android fleets and alert on installations below 150.0.7871.115
Correlate browser crash telemetry with URL history to identify pages that repeatedly trigger Autofill faults
Inspect proxy and DNS logs for mobile clients contacting domains associated with browser exploit delivery
Apply YARA or content rules to captured HTML that combines rapid Autofill DOM mutations with heap grooming patterns

Monitoring Recommendations

Enable mobile threat telemetry that reports Chrome build numbers and crash dumps to a central data lake
Track anomalous Autofill API usage and repeated form-focus event bursts from a single origin
Monitor mobile device management consoles for stalled or blocked Chrome updates
Alert on lateral behavior from mobile devices following visits to untrusted pages, such as new SSH or corporate VPN sessions initiated shortly after browsing events

How to Mitigate CVE-2026-15113

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.115 or later on every managed device
Force-push the Chrome update through mobile device management rather than relying on user-initiated updates
Restart the browser after patching to ensure the vulnerable process is no longer resident in memory
Review Android WebView and other Chromium-based mobile browsers for corresponding vendor updates

Patch Information

Google released the fix in Chrome for Android 150.0.7871.115 through the Stable channel. Details are available in the Google Blog Chrome Update. The associated Chromium bug is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable Autofill for forms and payment methods in Chrome settings until devices are patched
Restrict browsing on unpatched devices to a curated allowlist of trusted origins through MDM policies
Deploy DNS or secure web gateway filtering to block known malicious and newly registered domains from mobile devices
Educate users to avoid clicking untrusted links delivered via SMS, email, and messaging apps until updates are confirmed

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output after patching:
# versionName=150.0.7871.115