CVE-2026-15107: Chrome IndexedDB Use-After-Free RCE Vulnerability

Technical summary

CVE-2026-15107 is a use-after-free memory safety vulnerability (CWE-416) in Chrome's IndexedDB subsystem. The defect occurs when Chrome fails to properly manage memory references during IndexedDB operations, allowing an attacker-controlled HTML page to reference freed memory. When executed, this causes arbitrary code execution within the Chrome sandbox context. The vulnerability requires user action and network access but does not require elevated privileges or complex setup to exploit. The Chromium project classified the underlying issue as Medium severity internally, though the CVSS 3.1 score of 8.8 reflects the high impact of successful exploitation within the sandbox boundary.

Business impact

For organizations relying on Chrome for day-to-day operations, this vulnerability poses a data confidentiality and integrity risk. If exploited, an attacker could extract cached credentials, session tokens, browsing history, or data stored in web applications running in the browser. While the sandbox limits OS-level compromise, attackers could still access sensitive business data stored locally or in-flight within the browser process. Users who visit malicious or compromised websites are at direct risk, making this a concern for remote workers and any environment where Chrome is a primary business application.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. This includes all stable, beta, and development releases of Chrome published before the patch date. The vulnerability does not affect Chromium forks or other browsers, though users should verify their specific Chrome version against the published advisory. Organizations using Chrome on Windows, macOS, Linux, Android, and iOS should check their deployment versions; some enterprise deployments may have auto-update disabled or pinned versions that require manual intervention.

Exploitability

The vulnerability is exploitable remotely over the network and requires only that a user visit a crafted webpage—no special browser configuration or prior compromise is needed. The attack surface is broad because users can be tricked, socially engineered, or directed to malicious content via phishing emails, compromised websites, or malvertising. Once a user lands on the malicious page, the use-after-free is triggered automatically by the page's HTML/JavaScript. The exploit does not require bypassing additional protections like Content Security Policy; it operates within a normal browsing context. However, the sandboxing model limits the attacker's ability to escape and compromise the underlying operating system directly.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. For enterprise deployments, this update should be prioritized and deployed within 1–2 weeks, depending on your organization's risk tolerance and patch cycle. Verify compatibility with any business-critical extensions before deployment. For users with auto-update enabled, the patch is applied automatically. For those with updates disabled or in restricted environments, manual update or administrative deployment is required. No workaround exists other than updating; disabling IndexedDB or JavaScript is not a practical or supported mitigation.

Patch guidance

Apply the official Chrome update from Google's release channel or your organization's software distribution system. Verify installation by checking Chrome's version string (chrome://version) post-update to confirm the running version matches 150.0.7871.115 or higher. For enterprise administrators, use official Google Chrome for Business advisories and your patch management tools to deploy at scale. Test updates in a small group or lab environment first if your organization has complex extension dependencies. Monitor for any reported compatibility issues with common enterprise extensions after deployment.

Detection guidance

Detection in real-time is challenging because the vulnerability is triggered by visiting a crafted webpage and exploiting memory corruption—typical endpoint detection and response (EDR) tools may not flag the malicious page itself. Focus monitoring on: (1) Chrome process crashes or unexpected terminations (which may indicate failed exploitation or sandbox escape attempts); (2) unusual network activity from Chrome to known phishing or malware domains; (3) browser version inventory to identify outdated installations; (4) proxy or web gateway logs for access to known malicious URLs if available. Threat hunters should prioritize users in high-risk roles (finance, HR, executives) who may be targeted by phishing campaigns delivering this exploit.

Why prioritize this

Despite Chromium's internal 'Medium' severity rating, the CVSS 8.8 HIGH score reflects the practical risk: arbitrary code execution within the browser, low attack complexity, no privilege requirements, and user interaction as the only barrier. Chrome's ubiquity in enterprise environments amplifies exposure. The use-after-free class (CWE-416) is a common attack vector refined by sophisticated threat actors. Organizations should treat this as a high-priority patch, particularly for users handling sensitive data or in roles targeted by social engineering.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) is driven by: (1) Network accessibility (AV:N) allows remote exploitation; (2) Low attack complexity (AC:L) means no special conditions are needed; (3) No privileges required (PR:N); (4) User interaction required (UI:R) limits immediate worm-like spread but is easily satisfied; (5) Scope unchanged (S:U) limits cross-boundary impact but (6) high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) within the sandbox. The score balances the sandbox boundary against the ease and breadth of triggering the flaw and its full compromise of the browser process.

Frequently asked questions