CVE-2026-15117: Google Chrome Use After Free Vulnerability

CVE-2026-15117 Overview

CVE-2026-15117 is a use-after-free vulnerability in the Payments component of Google Chrome versions prior to 150.0.7871.115. The flaw allows a remote attacker to trigger heap corruption through a crafted HTML page when a user performs specific UI gestures. Successful exploitation can lead to arbitrary code execution within the renderer process. The vulnerability is tracked under [CWE-416] and was addressed in the Chrome Stable channel update. Chromium security engineers rated the internal severity as High.

Critical Impact
Remote attackers can trigger heap corruption in the Chrome Payments component, potentially achieving code execution in the renderer sandbox after user interaction with a malicious page.

Affected Products

Google Chrome (Desktop) prior to 150.0.7871.115
Chromium-based browsers incorporating the vulnerable Payments code
All operating systems supported by Chrome Stable channel

Discovery Timeline

2026-07-08 - CVE-2026-15117 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15117

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition in the Payments subsystem of the Chrome browser. Use-after-free bugs occur when a program continues to reference memory after it has been freed. An attacker who controls the contents of the reallocated memory region can corrupt heap metadata or hijack control flow.

Exploitation requires a user to visit a crafted HTML page and perform specific user interface gestures. These gestures manipulate the lifecycle of Payments objects, causing dangling pointers to be dereferenced. The result is heap corruption within the renderer process, which attackers commonly chain with sandbox escapes to achieve full system compromise.

Root Cause

The root cause is improper object lifetime management inside the Payments component. Callback handlers or asynchronous tasks retain references to Payment-related objects that have already been destroyed. When those references are invoked, the freed memory is accessed, satisfying the conditions described in [CWE-416].

Attack Vector

The attack vector is network-based. An attacker hosts a malicious web page that invokes the Payment Request API or related Payments UI flows. The victim must interact with the page, such as clicking a payment prompt or dismissing a dialog. This user gesture requirement raises attack complexity but does not eliminate the risk of drive-by exploitation through phishing or malvertising campaigns.

No verified public proof-of-concept is available. Technical details are described in the Chromium Issue Tracker #522568496 and the Google Chrome Stable Update release notes.

Detection Methods for CVE-2026-15117

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures shortly after visiting untrusted pages invoking PaymentRequest APIs
Unexpected child processes spawned by chrome.exe after user interaction with payment prompts
Outbound network connections from renderer processes to unfamiliar domains hosting payment-related HTML content

Detection Strategies

Inventory endpoints running Chrome versions below 150.0.7871.115 using software asset management tooling
Monitor browser telemetry for renderer crashes referencing Payments or payments:: symbols in stack traces
Correlate web proxy logs with browser process behavior to identify sessions invoking PaymentRequest from low-reputation origins

Monitoring Recommendations

Enable enterprise Chrome crash reporting and forward crash dumps to a centralized analysis pipeline
Alert on post-exploitation behaviors such as renderer processes writing executables to disk or loading unsigned DLLs
Track Chrome version compliance across the fleet through group policy or MDM reporting

How to Mitigate CVE-2026-15117

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all endpoints
Restart the browser after applying the update to ensure the patched binaries are loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream fixes

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update. Enterprise administrators should force a browser relaunch through management policy to guarantee the fix is active on all managed devices.

Workarounds

Restrict use of the Payment Request API through enterprise browser policy where feasible
Deploy web filtering to block access to untrusted or newly registered domains that solicit payment interactions
Educate users to avoid interacting with unexpected payment prompts on unfamiliar websites

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on Linux
google-chrome --version

# Force update check via command line
google-chrome --check-for-update-interval=1