CVE-2026-15120: Google Chrome Use After Free Vulnerability

CVE-2026-15120 Overview

CVE-2026-15120 is a use-after-free vulnerability in the Core component of Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.115. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. The Chromium project rated the security severity as High, and the issue is tracked under CWE-416. Successful exploitation would allow code execution outside the renderer's restricted context, elevating attacker capability against the host operating system.

Critical Impact
Chained with a renderer compromise, this flaw permits sandbox escape from a crafted web page, giving attackers execution capability at the browser process level on Windows hosts.

Affected Products

Google Chrome on Windows prior to 150.0.7871.115
Chromium-based browsers that incorporate the vulnerable Core component
Downstream distributions that had not yet integrated the upstream fix at publication

Discovery Timeline

2026-07-08 - CVE-2026-15120 published to NVD
2026-07-09 - Last updated in NVD database
2026-07 - Google publishes Stable Channel update for Desktop addressing the issue via the Google Chrome Update Announcement and the Chromium Issue Tracker Entry

Technical Details for CVE-2026-15120

Vulnerability Analysis

The vulnerability is a use-after-free condition inside Chrome's Core code path. Use-after-free bugs occur when a program continues to reference memory after it has been released back to the allocator. An attacker who controls the freed allocation's replacement contents can steer object dispatch, virtual table lookups, or callback pointers toward attacker-controlled data.

In this case, the flaw is reachable from a crafted HTML page. However, the NVD description states the attacker must already have compromised the renderer process. This places the bug in the sandbox-escape class rather than initial-access class. Chrome's multi-process architecture confines untrusted web content to a low-privilege renderer. A sandbox escape breaks that boundary and exposes the browser process, which has broader access to the host.

Root Cause

The root cause is object lifetime mismanagement in a Core component. A reference to a heap object persists after the object's destructor runs, and subsequent dereference through that stale pointer operates on memory the allocator may have reissued for a different purpose. This category is tracked as CWE-416: Use After Free.

Attack Vector

Exploitation follows a two-stage chain. First, the attacker compromises the renderer, typically through a separate memory-corruption primitive delivered via a malicious page. Second, the attacker triggers the vulnerable code path in Core to reach the dangling pointer and pivot execution outside the sandbox. The CVSS vector reflects this by requiring high attack complexity, user interaction, and a scope change once the boundary is crossed.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics remain restricted in the Chromium Issue Tracker Entry pending broad patch uptake.

Detection Methods for CVE-2026-15120

Indicators of Compromise

Chrome browser processes on Windows spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe outside normal update flows
Unexpected writes to %LOCALAPPDATA%\Google\Chrome\User Data\ or persistence artifacts under the Chrome installation path
Endpoints running Chrome versions earlier than 150.0.7871.115 after the patch release date

Detection Strategies

Inventory installed Chrome versions across the Windows fleet and flag any host below 150.0.7871.115
Alert on Chrome renderer or browser process crashes clustered around common HTML rendering paths, which may indicate exploitation attempts
Correlate outbound network activity from Chrome processes with process-injection or credential-access behaviors that would follow a successful sandbox escape

Monitoring Recommendations

Enable browser telemetry forwarding, including crash reports, to a central log platform for anomaly review
Monitor for child processes of chrome.exe that are not part of the Google update or crash-handler set
Track user navigation to newly registered or low-reputation domains delivering active HTML content while unpatched Chrome versions remain in the environment

How to Mitigate CVE-2026-15120

Immediate Actions Required

Update Google Chrome on Windows to version 150.0.7871.115 or later using the Stable Channel release
Force-close and relaunch Chrome after the update to load the patched binaries into all renderer and browser processes
Validate patch deployment via chrome://version or centralized software-inventory reporting

Patch Information

Google addressed CVE-2026-15120 in the Chrome Stable Channel update announced in the Google Chrome Update Announcement. The fix is included in Chrome 150.0.7871.115 for Windows. Chromium downstream vendors should integrate the corresponding upstream commit referenced in the Chromium Issue Tracker Entry.

Workarounds

Enforce Chrome auto-update via enterprise policy so that endpoints receive the fix without user action
Restrict browsing to trusted sites through URL allowlisting for high-risk user groups until patching completes
Disable or restrict experimental Chrome flags that widen the renderer attack surface on unpatched hosts

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Trigger Chrome update check via Google Update
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler