CVE-2026-15118: Google Chrome Use-After-Free Vulnerability

CVE-2026-15118 Overview

CVE-2026-15118 is a use-after-free vulnerability in the Input component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.115 and allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google's Chromium team classified the security severity as High.

The vulnerability is tracked under CWE-416: Use After Free and requires user interaction, typically a victim visiting a malicious web page. Successful exploitation grants attackers code execution within the renderer process, providing a foothold for further sandbox escape chains.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by luring users to a malicious HTML page, compromising the confidentiality, integrity, and availability of the browser process.

Affected Products

Google Chrome versions prior to 150.0.7871.115 (Stable channel)
Chromium-based browsers sharing the vulnerable Input component code
Desktop platforms distributing Chrome Stable prior to the July 2026 update

Discovery Timeline

2026-07-08 - CVE-2026-15118 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in the NVD database

Technical Details for CVE-2026-15118

Vulnerability Analysis

The vulnerability resides in Chrome's Input component, which handles user input events including keyboard, mouse, pointer, and touch interactions before dispatching them to the renderer's event pipeline. A use-after-free condition occurs when the component references a memory object after it has been freed, allowing attackers to influence the contents of the reallocated memory region.

An attacker who controls the freed allocation can craft object layouts that lead to arbitrary code execution within the renderer process. Because rendering runs inside the Chrome sandbox, the resulting execution is initially confined, but it provides a base for chained sandbox escape exploits. The high impact ratings across confidentiality, integrity, and availability reflect full renderer compromise.

Root Cause

The root cause is improper lifetime management of an object referenced by the Input subsystem. When an event handler or associated DOM state is torn down, a dangling pointer persists and is subsequently dereferenced. This pattern is characteristic of CWE-416 and frequently emerges in event-driven code paths where object ownership crosses task or thread boundaries.

Attack Vector

Exploitation requires a victim to load attacker-controlled content in Chrome. The attacker hosts a crafted HTML page that triggers specific input event sequences and DOM manipulations, causing the vulnerable object to be freed while a stale reference remains reachable. Follow-up JavaScript replaces the freed memory with attacker-shaped data, hijacking control flow when the stale pointer is used.

The attack requires no authentication and can be delivered through phishing links, malvertising, or drive-by download campaigns. See the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2026-15118

Indicators of Compromise

Chrome renderer process crashes with access violations referencing input event handling stack frames
Outbound connections from chrome.exe child renderer processes to unfamiliar domains shortly after browsing activity
Unexpected child processes spawned from Chrome renderer processes, which normally do not spawn shells or scripting hosts
Browser telemetry showing Chrome versions below 150.0.7871.115 on managed endpoints

Detection Strategies

Inventory installed Chrome builds across the fleet and alert on versions prior to 150.0.7871.115
Monitor for anomalous process lineage originating from Chrome renderer processes, a common signal of successful renderer compromise
Correlate crash dumps in the Input subsystem with subsequent network or process activity to surface exploitation attempts

Monitoring Recommendations

Ingest browser version telemetry into your SIEM or data lake to track patch compliance over time
Enable EDR process-tree visibility on all endpoints to catch post-exploitation behavior following renderer compromise
Monitor DNS and web proxy logs for access to newly registered or low-reputation domains delivering HTML payloads

How to Mitigate CVE-2026-15118

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all managed endpoints
Force-restart Chrome after deploying the update to ensure the patched binary is loaded into memory
Audit Chromium-based browsers and Electron applications for vulnerable upstream versions and update accordingly
Communicate the update requirement to users on unmanaged or BYOD devices accessing corporate resources

Patch Information

Google addressed the vulnerability in Chrome Stable 150.0.7871.115. Details are published in the Google Chrome Stable Update advisory. Enterprise administrators should deploy the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.

Workarounds

No official workaround exists; patching is the only supported remediation
Restrict browsing to trusted sites via URL filtering until the patch is deployed
Enable Chrome's Site Isolation and ensure the sandbox is not disabled through command-line flags
Consider temporarily disabling JavaScript on high-risk user groups where feasible

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version