CVE-2026-15901: Google Chrome Use-After-Free Vulnerability

CVE-2026-15901 Overview

CVE-2026-15901 is a use-after-free vulnerability [CWE-416] in the Network component of Google Chrome. Versions of Chrome prior to 150.0.7871.128 are affected. A remote attacker can exploit heap corruption by convincing a user to visit a crafted HTML page. Google rated the Chromium security severity as Critical.

The flaw allows an attacker to trigger memory reuse conditions within the browser's networking stack. Successful exploitation can lead to arbitrary code execution within the renderer or network service process context. User interaction is required, typically in the form of visiting a malicious website.

Critical Impact
Remote attackers can trigger heap corruption in the Chrome Network component through a crafted HTML page, potentially leading to arbitrary code execution.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.128
Chromium-based browsers incorporating the vulnerable Network component
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-07-20 - CVE-2026-15901 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15901

Vulnerability Analysis

The vulnerability resides in the Network component of Google Chrome. It is classified as a use-after-free condition, tracked under [CWE-416]. Use-after-free defects arise when a program continues to reference memory after that memory has been released back to the allocator.

When the freed memory is reallocated for a different object, subsequent operations on the stale pointer read or write attacker-influenced data. In browser contexts, this class of bug frequently leads to type confusion, heap corruption, and control-flow hijacking. The Network component handles URL loading, HTTP transactions, and resource fetching, making it reachable through standard web content.

Exploitation requires the victim to render a crafted HTML page. The attacker delivers the page through a malicious site, compromised domain, malvertising, or a link in phishing content. Because the attack occurs across a network boundary and needs only limited user interaction, the exposure is broad across enterprise browsing populations.

Root Cause

The root cause is object lifetime mismanagement inside Chrome's networking code. A network object is released while another code path still holds a reference to it. Later dereferences of that reference operate on freed heap memory, producing exploitable heap corruption.

Attack Vector

The attack vector is remote and network-based. An attacker hosts a crafted HTML page that issues specific network operations designed to trigger the freed-pointer condition. When a user loads the page, the malicious content manipulates the heap layout and drives execution into the vulnerable code path. No authentication is required, and the interaction cost is limited to visiting a page.

Detailed proof-of-concept code has not been published. Technical background is available through the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.

Detection Methods for CVE-2026-15901

Indicators of Compromise

Unexpected Chrome renderer or network service process crashes correlated with browsing activity
Outbound connections from Chrome child processes to previously unseen domains immediately after a page load
Creation of persistence artifacts (scheduled tasks, registry Run keys, launch agents) spawned from a Chrome process tree
Endpoint telemetry showing Chrome child processes writing executables or scripts to disk

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 150.0.7871.128
Alert on anomalous child processes launched by chrome.exe, Google Chrome Helper, or the network service process
Correlate browser crash reports with proxy and DNS logs to identify pages triggering repeatable faults
Deploy behavioral rules that identify heap corruption exploitation patterns such as unexpected memory protection changes in browser processes

Monitoring Recommendations

Ingest browser version telemetry into the SIEM to continuously track patch compliance
Monitor web proxy logs for high-risk categories and newly registered domains delivering active content
Enable enhanced Chrome crash reporting and forward reports to a central analysis pipeline
Track process lineage from Chrome to any shell interpreter, LOLBin, or scripting engine

How to Mitigate CVE-2026-15901

Immediate Actions Required

Update Google Chrome to version 150.0.7871.128 or later on all managed endpoints
Force restart of running Chrome instances to ensure the patched binary is loaded
Push updates to Chromium-based browsers once vendor-specific builds incorporating the fix are released
Restrict access to untrusted sites via web filtering while the patch is being deployed

Patch Information

Google addressed CVE-2026-15901 in the Stable channel update documented in the Google Chrome Update Announcement. Administrators should deploy Chrome 150.0.7871.128 or later. Enterprises using managed Chrome deployments should validate that the auto-update service is enabled and that policy does not pin an older version.

Workarounds

Enforce Site Isolation and strict process-per-site policies through Chrome enterprise policy
Disable or constrain execution of untrusted JavaScript using enterprise content policies where feasible
Route browsing traffic through a security web gateway that blocks known malicious domains and inspects active content
Reduce browser attack surface by disabling unused features and extensions through group policy

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version