CVE-2026-15116: Google Chrome Use After Free Vulnerability

CVE-2026-15116 Overview

CVE-2026-15116 is a use-after-free vulnerability [CWE-416] in the Actor component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.115. A remote attacker can execute arbitrary code inside the Chrome sandbox by tricking a user into loading a crafted HTML page. Google rates the Chromium security severity as High. The vulnerability requires user interaction, typically visiting a malicious or compromised web page. Successful exploitation compromises the confidentiality, integrity, and availability of the affected renderer process.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome sandbox through a crafted HTML page, enabling browser compromise and potentially serving as the first stage of a sandbox escape chain.

Affected Products

Google Chrome versions prior to 150.0.7871.115
Chromium-based browsers incorporating the vulnerable Actor component
Desktop stable channel builds across Windows, macOS, and Linux

Discovery Timeline

2026-07-08 - CVE-2026-15116 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15116

Vulnerability Analysis

CVE-2026-15116 is a use-after-free condition in the Actor component of Google Chrome. Use-after-free flaws occur when a program continues to reference memory after it has been released. An attacker who influences the freed allocation can control the object contents and hijack subsequent code paths that dereference the stale pointer. In Chrome, such flaws in web-reachable components frequently lead to arbitrary code execution inside the renderer sandbox. According to the advisory, the attacker delivers the exploit through a crafted HTML page, meaning user interaction such as visiting a page is required. The Chromium security team classifies the severity as High, consistent with reliable renderer compromise.

Root Cause

The root cause is improper lifetime management within the Actor subsystem. Object references remain in use after the underlying allocation is freed, violating memory-safety invariants tracked by [CWE-416]. Detailed technical specifics are restricted while users update, a standard Chromium disclosure practice.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must load an attacker-controlled HTML page, for example through a malicious link, malvertising, or a compromised site. The initial code execution is confined to the Chrome sandbox but provides a foothold for chained sandbox-escape vulnerabilities. No verified public exploit code is available at the time of publication. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor detail.

Detection Methods for CVE-2026-15116

Indicators of Compromise

Chrome renderer processes crashing or spawning unexpected child processes shortly after browsing to an unfamiliar domain
Outbound connections from chrome.exe to newly registered or low-reputation domains hosting HTML payloads
Unexpected file writes under user profile directories initiated by renderer processes

Detection Strategies

Inventory Chrome installations across the fleet and flag versions below 150.0.7871.115 as vulnerable
Monitor endpoint telemetry for anomalous behavior originating from browser processes, such as memory-region protection changes or thread injection attempts
Correlate web proxy logs with browser crash telemetry to identify pages that trigger renderer failures

Monitoring Recommendations

Enable browser crash reporting and forward chrome.exe crash dumps to central logging for review
Ingest EDR process-tree and network telemetry into a SIEM to detect post-exploitation activity following renderer compromise
Track DNS and HTTP requests to domains delivering large or obfuscated HTML payloads that match malvertising patterns

How to Mitigate CVE-2026-15116

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all managed endpoints
Restart the browser after installation so that the patched binary is loaded into memory
Restrict browsing on unpatched systems and prioritize endpoints exposed to untrusted web content

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Update Announcement. Administrators should push Chrome 150.0.7871.115 or later through enterprise management tools such as Group Policy, Jamf, Intune, or the Chrome Browser Cloud Management console. Chromium-based browsers that embed the Actor component should be updated once their vendors ship the corresponding merge.

Workarounds

Enforce Chrome auto-update policies and disable the ability for users to defer browser updates
Deploy web filtering to block access to uncategorized and low-reputation domains until patching completes
Apply the principle of least privilege on endpoints so that any post-sandbox activity has limited impact

bash

# Verify the installed Chrome version on Linux or macOS
google-chrome --version

# Windows registry check for the deployed Chrome version
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version