CVE-2026-15129: Google Chrome Use After Free Vulnerability

CVE-2026-15129 Overview

CVE-2026-15129 is a use-after-free vulnerability [CWE-416] in the Views component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.115. A remote attacker can trigger heap corruption by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Critical, and the NVD assigns a CVSS 3.1 base score of 8.8.

Exploitation requires user interaction, such as visiting a malicious website or opening a crafted page. Successful exploitation can lead to arbitrary code execution within the renderer process, providing a foothold for sandbox escape chains.

Critical Impact
Remote attackers can corrupt heap memory in Chrome's Views subsystem through a crafted HTML page, enabling potential code execution on the victim's system.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.115
Chromium-based browsers using vulnerable Views component builds
Downstream distributions embedding pre-patch Chromium releases

Discovery Timeline

2026-07-08 - CVE-2026-15129 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15129

Vulnerability Analysis

The vulnerability resides in the Views component, Chrome's cross-platform user interface framework responsible for rendering browser UI elements. A use-after-free condition occurs when code retains and dereferences a pointer to a Views object after the underlying memory has been released.

When an attacker crafts HTML that manipulates the lifecycle of Views-managed objects, the browser can free memory while a dangling reference remains active. Subsequent access to that reference reads or writes freed heap memory. Attackers can groom the heap so that controlled data occupies the freed region, converting the memory error into a controlled read, write, or virtual function call.

Because the flaw is triggered from web content, it is reachable from the renderer process. Combined with a sandbox escape, it can yield arbitrary code execution at the user's privilege level.

Root Cause

The root cause is improper object lifetime management within Views [CWE-416]. Reference counting or ownership handoff logic releases a Views object while other code paths continue to hold and use pointers to it, violating memory safety guarantees.

Attack Vector

The attack vector is network-based. A remote attacker hosts a crafted HTML page or delivers malicious content through advertisements, iframes, or compromised sites. The victim triggers the vulnerability by loading the page in an unpatched Chrome build. No authentication is required, but user interaction is necessary.

No public proof-of-concept exploit code is available for CVE-2026-15129 at the time of publication. Technical details are restricted in the Chromium issue tracker per Google's standard disclosure policy. Refer to the Google Chrome Release Update and Chromium Issue Tracker Entry for authoritative details.

Detection Methods for CVE-2026-15129

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures such as SIGSEGV in Views-related call stacks
Unexpected child process creation spawned by chrome.exe following navigation to untrusted pages
Outbound connections from renderer processes to unknown command-and-control infrastructure
Presence of Chrome versions earlier than 150.0.7871.115 reported by endpoint inventory

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running builds prior to 150.0.7871.115
Monitor Chrome crash telemetry for use-after-free and heap-buffer-overflow reports referencing the Views module
Correlate browser navigation events with subsequent anomalous process, file, or network activity to surface exploitation attempts

Monitoring Recommendations

Enable enterprise Chrome crash reporting and review reports for repeated Views-related faults
Log DNS and HTTP telemetry from user endpoints to identify navigation to newly registered or low-reputation domains
Track child process creation from browser processes and alert on execution of shells, scripting engines, or LOLBins

How to Mitigate CVE-2026-15129

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after the update to ensure the patched binary is loaded
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or Group Policy
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream-patched releases

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. Upgrade to Chrome 150.0.7871.115 or later. See the Google Chrome Release Update for the full advisory and the Chromium Issue Tracker Entry for issue metadata.

Workarounds

Restrict browsing to trusted sites through enterprise URL allowlists until patching completes
Disable or block third-party ad networks and untrusted iframes at the network perimeter to reduce exposure to malicious HTML
Enforce Site Isolation and standard Chrome sandbox settings so exploitation is contained to the renderer where possible

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy example: force auto-update to latest stable
# /etc/opt/chrome/policies/managed/chrome-update.json
{
  "TargetVersionPrefix": "150.0.7871.115",
  "DefaultBrowserSettingEnabled": true
}