CVE-2026-15767: Google Chrome Buffer Overflow Vulnerability

CVE-2026-15767 Overview

CVE-2026-15767 is a heap buffer overflow vulnerability in the libyuv component of Google Chrome on Windows prior to version 150.0.7871.125. A remote attacker can execute arbitrary code inside the Chrome sandbox by delivering a crafted video file to the target browser. The flaw is tracked as CWE-122: Heap-based Buffer Overflow and carries a Chromium security severity rating of High.

Exploitation requires user interaction, such as visiting an attacker-controlled page or loading a malicious video resource. Successful exploitation grants code execution inside the sandboxed renderer process, providing a foothold for follow-on sandbox escape attempts.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome renderer sandbox by serving a crafted video file to any user running an unpatched Chrome build on Windows.

Affected Products

Google Chrome on Windows prior to 150.0.7871.125
Microsoft Windows platforms running vulnerable Chrome builds
Chromium-based applications embedding the vulnerable libyuv component

Discovery Timeline

2026-07-14 - CVE-2026-15767 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15767

Vulnerability Analysis

The vulnerability resides in libyuv, the open-source YUV color-space conversion and scaling library used by Chrome for video frame processing. A heap buffer overflow occurs when the library processes a maliciously crafted video file, writing beyond the bounds of a heap-allocated buffer.

Chrome invokes libyuv routines during decoding and rendering of video content across multiple pipelines, including WebRTC, HTML5 <video>, and MediaSource Extensions. Any of these delivery paths can trigger the overflow when the crafted media is parsed.

Successful exploitation yields arbitrary code execution within the renderer process. While the Chrome sandbox contains the initial payload, attackers typically chain this class of bug with a separate sandbox escape to achieve full system compromise.

Root Cause

The root cause is an out-of-bounds heap write in libyuv conversion or scaling logic, categorized as [CWE-122]. Crafted video dimensions or stride parameters cause the library to compute an undersized destination allocation while writing a larger amount of pixel data, corrupting adjacent heap metadata and objects.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted video file on a web page, embeds it in an advertisement, or delivers it through any origin that Chrome will load. When the browser decodes the video, the overflow triggers and attacker-controlled data is written into the renderer heap.

No authentication is required. See the Chromium Issue Tracker Entry for additional technical context and the Google Chrome Update Announcement for release details.

Detection Methods for CVE-2026-15767

Indicators of Compromise

Unexpected renderer process crashes in Chrome with heap corruption signatures shortly after loading video content
Chrome child processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound connections from chrome.exe renderer processes to newly registered or low-reputation domains hosting media files

Detection Strategies

Inventory Chrome installations across Windows endpoints and flag any version below 150.0.7871.125 as vulnerable
Monitor for anomalous process lineage where chrome.exe renderer children invoke shell or scripting binaries
Correlate browser crash telemetry with recent navigation events involving video MIME types to identify targeted exploitation attempts

Monitoring Recommendations

Ingest Chrome crash reports and Windows Error Reporting (WER) data into a SIEM for pattern analysis
Alert on writes to autorun locations or persistence mechanisms initiated by Chrome renderer descendants
Track EPSS score movement for CVE-2026-15767 (currently 0.311%) to detect increased exploitation likelihood over time

How to Mitigate CVE-2026-15767

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 150.0.7871.125 or later
Restart Chrome after the update to ensure the patched libyuv binary is loaded
Audit and update Chromium-based applications and embedded frameworks that ship their own copy of libyuv

Patch Information

Google addressed CVE-2026-15767 in the Chrome Stable channel release 150.0.7871.125 for Windows. Deployment details are available in the Google Chrome Update Announcement. Enterprises using managed Chrome deployments should push the update through Group Policy or their endpoint management platform.

Workarounds

Enforce Chrome auto-update policies through Group Policy to guarantee timely patching
Restrict access to untrusted video content through web filtering and URL categorization until patches are deployed
Disable autoplay for media elements to reduce the chance of passive exploitation on attacker-controlled pages

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome update check via command line
"C:\Program Files\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1