CVE-2026-15774: Google Chrome Use After Free Vulnerability

CVE-2026-15774 Overview

CVE-2026-15774 is a use-after-free vulnerability [CWE-416] in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.125. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium team classified the security severity as High. The bug resides in Skia, the 2D graphics engine that Chrome uses for rendering across desktop platforms.

Critical Impact
Successful exploitation enables a sandbox escape from a compromised renderer, allowing an attacker to execute code outside Chrome's renderer sandbox with broader access to the host system.

Affected Products

Google Chrome (Desktop) versions prior to 150.0.7871.125
Chromium-based browsers incorporating vulnerable Skia builds
Downstream distributions bundling affected Chromium releases

Discovery Timeline

2026-07-14 - CVE-2026-15774 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15774

Vulnerability Analysis

The vulnerability is a use-after-free condition in Skia, the graphics library that renders 2D content in Chrome. Use-after-free bugs occur when memory is referenced after it has been released back to the allocator. An attacker who controls the freed region can influence object layout and force the browser to dereference attacker-controlled memory.

In this case, the flaw is reachable through content processed by the renderer. Skia handles complex graphics operations including path rendering, image decoding, and GPU-backed drawing. Any of these code paths can hold references to objects whose lifetimes are not correctly managed under specific rendering sequences.

Exploitation requires user interaction, meaning the victim must load or interact with a crafted HTML page. The scope is marked as changed, reflecting that a successful sandbox escape crosses a trust boundary from the renderer process to more privileged Chrome components or the host.

Root Cause

The root cause is improper object lifetime management inside Skia. A pointer or reference to a Skia object continues to be used after the underlying memory has been freed. When the freed allocation is reclaimed and reshaped by attacker-controlled data, subsequent operations on the dangling reference lead to memory corruption exploitable for sandbox escape.

Attack Vector

Exploitation follows a two-stage chain. First, the attacker must already have compromised the renderer process, typically through a separate renderer bug. Second, the attacker serves a crafted HTML page that triggers the Skia use-after-free to break out of the sandbox. The attack vector is network-based, with high attack complexity, and requires user interaction such as visiting a malicious site.

The vulnerability mechanism is described in the Chromium Issue Tracker Entry. No public proof-of-concept is available at this time.

Detection Methods for CVE-2026-15774

Indicators of Compromise

Chrome renderer or GPU process crashes with signatures pointing to Skia modules following visits to untrusted pages
Unexpected child processes spawned by chrome.exe or the Chrome helper process on macOS and Linux
Outbound connections from browser processes to newly registered or low-reputation domains hosting graphics-heavy payloads

Detection Strategies

Monitor endpoint telemetry for Chrome process anomalies, including renderer crashes correlated with navigation to specific URLs
Inspect browser crash dumps for Skia-related stack frames such as SkCanvas, SkPath, or GPU raster paths
Correlate browser exploitation attempts with follow-on activity such as suspicious file writes, script interpreter launches, or credential access

Monitoring Recommendations

Track deployed Chrome versions across the fleet and flag any endpoint below 150.0.7871.125
Alert on browser processes performing behavior outside their normal profile, such as loading unusual DLLs or making raw system calls
Feed browser process telemetry into a central analytics platform to identify exploitation patterns across users

How to Mitigate CVE-2026-15774

Immediate Actions Required

Update Google Chrome to version 150.0.7871.125 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded Chromium components for vulnerable Skia builds and update accordingly

Patch Information

Google addressed CVE-2026-15774 in the Stable channel update announced in the Chrome Blog Update. The fix is included in Chrome 150.0.7871.125 and later. Administrators should verify update deployment through enterprise policy management and confirm the version string in chrome://version.

Workarounds

Enforce Chrome auto-updates through enterprise policy to reduce exposure windows for future browser vulnerabilities
Restrict browsing to trusted sites via URL filtering while patching is in progress
Deploy site isolation and strict process sandboxing settings to raise the cost of chained exploitation

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version