CVE-2026-15905: Google Chrome Aura Use-After-Free Flaw

CVE-2026-15905 Overview

CVE-2026-15905 is a use-after-free vulnerability [CWE-416] in the Aura component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.128. A local attacker can trigger heap corruption by convincing a user to open a malicious file. Google's Chromium security team rated the issue as High severity.

Successful exploitation may lead to arbitrary code execution within the Chrome process. Aura is Chrome's cross-platform windowing and compositing framework, making the affected code path reachable during normal browser usage.

Critical Impact
A local attacker who delivers a malicious file to a targeted user can corrupt the heap in the Chrome renderer or browser process, potentially achieving code execution in the user's security context.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.128
Chromium-based browsers incorporating the vulnerable Aura component
All platforms where Chrome uses the Aura windowing framework (Windows, Linux, ChromeOS)

Discovery Timeline

2026-07-20 - CVE-2026-15905 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-15905

Vulnerability Analysis

The vulnerability is a use-after-free condition in Aura, the windowing system used by Chrome for window management, event routing, and compositor integration. Use-after-free bugs occur when memory is freed while a pointer to that memory remains in use. Subsequent access to the dangling pointer allows an attacker to read or write memory that has been reallocated for other purposes.

In Chrome, exploitation of a use-after-free in Aura typically results in heap corruption. Attackers who control the freed allocation can groom the heap to place attacker-influenced data at the reused location. This primitive can be chained with additional bugs to bypass mitigations such as ASLR and achieve code execution.

The attack requires local access and user interaction. The user must open a malicious file processed by Chrome for the vulnerable code path to be reached.

Root Cause

The root cause is improper object lifetime management within the Aura framework. A referenced object is destroyed while another component retains a raw pointer or reference. Details of the specific object and code path are tracked in Chromium Issue Tracker #532970574 and remain access-restricted pending broader patch adoption.

Attack Vector

Exploitation requires a local attack vector with user interaction. An attacker crafts a malicious file that, when opened by Chrome, causes Aura to reach the vulnerable code path. Once heap corruption occurs, the attacker can attempt to gain code execution within the browser process boundary. Refer to the Google Chrome Stable Channel Update for the official advisory.

Detection Methods for CVE-2026-15905

Indicators of Compromise

Unexpected Chrome process crashes with heap corruption signatures in Windows Error Reporting or core dump files
Chrome child processes spawning non-browser executables such as cmd.exe, powershell.exe, or shell interpreters
Suspicious file downloads immediately preceding Chrome instability or crash events

Detection Strategies

Inventory endpoint Chrome versions and flag any installation below 150.0.7871.128
Monitor for anomalous process trees originating from chrome.exe, particularly spawning of scripting engines or LOLBins
Correlate file-open events for uncommon extensions with subsequent Chrome renderer or GPU process crashes

Monitoring Recommendations

Enable telemetry for Chrome crash reports and forward them to a central log platform for triage
Track browser update compliance via endpoint management to ensure users receive the fixed build
Alert on Chrome creating executables in user-writable directories such as %APPDATA% or /tmp

How to Mitigate CVE-2026-15905

Immediate Actions Required

Update Chrome to version 150.0.7871.128 or later on all Windows, Linux, and ChromeOS endpoints
Verify auto-update is enabled and functioning by checking chrome://settings/help on managed fleets
Restrict opening of untrusted files in Chrome via endpoint policy and user awareness communications

Patch Information

Google released the fix in Chrome Stable Channel version 150.0.7871.128. Administrators should reference the Google Chrome Stable Channel Update for full details on all issues addressed in the release. Managed environments should push the update through enterprise tooling such as Google Admin Console, Microsoft Intune, or equivalent.

Workarounds

No official workaround is available; patching is the only supported remediation
Limit exposure by blocking downloads of high-risk file types at the web proxy or email gateway until patching is complete
Enforce site isolation and standard user (non-administrator) accounts to reduce the impact of successful exploitation

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Force update check on macOS/Linux managed hosts
google-chrome --check-for-update-interval=1