CVE-2026-15109: ANGLE Memory Disclosure in Chrome – Patching Guide

Technical summary

CVE-2026-15109 is an uninitialized memory use vulnerability (CWE-457) in the ANGLE graphics driver abstraction component of Google Chrome. When ANGLE processes specially crafted HTML and graphics commands, it may fail to initialize certain memory buffers before use. An attacker can craft a webpage that triggers this condition, causing the GPU driver interface to expose uninitialized heap or stack memory to the JavaScript context running on the page. This circumvents browser sandboxing protections by leveraging a logic flaw in graphics command processing rather than a direct memory corruption bug.

Business impact

For enterprises, this vulnerability presents a data exfiltration risk for any user accessing attacker-controlled or compromised websites. Users handling sensitive information—credentials, API keys, personally identifiable data—could have that information leaked from browser memory without additional exploitation steps. While the attack requires user interaction, the low attack complexity means the malicious page can be hosted anywhere and requires no special privileges or advanced techniques. Organizations relying on Chrome for critical workflows should prioritize updating to close this window of exposure.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. All platforms running vulnerable Chrome releases—Windows, macOS, and Linux—are in scope. This includes Chrome on desktop, and any Chromium-based browsers that have not incorporated the security patch. Users on auto-update should receive the fix automatically; however, organizations with delayed update policies may need to force an update cycle.

Exploitability

Exploitability is straightforward from an attacker perspective. The vulnerability requires only network access and user interaction (clicking a link or visiting a page), with no special privileges or authentication needed. The attack surface is broad: any website, advertisement, or email link could deliver the payload. However, the attacker's ability to extract *specific* sensitive data depends on what happens to reside in uninitialized memory at the moment of exploitation, making targeted attacks less reliable than opportunistic ones. The Chromium security team rated this High severity, though the CVSS 3.1 score of 6.5 reflects the requirement for user action.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. For enterprise deployments, verify patch deployment through your device management or software distribution tools. Ensure auto-update is enabled if your organization permits it. Users on manual update cycles should check Settings > About Chrome and apply the update immediately. No workarounds exist; patching is the only mitigation.

Patch guidance

Chrome releases security patches on a regular schedule. Verify the latest stable release version on the official Chrome release notes or Google's security advisory. Version 150.0.7871.115 or later contains the fix; check your current version in Settings > About Chrome, which will also automatically check for and offer to install updates. For organizations managing Chrome via policies or MDM, update your deployment manifests or policy templates to enforce the minimum patched version. Extended Stable release channels may lag; confirm your support model.

Detection guidance

Detection of exploitation is challenging in real-time because the attack manifests as normal GPU rendering with memory disclosure—not crashing or obvious abnormal behavior. Monitor for: (1) Chrome version inventory in your endpoint security tools; (2) users visiting known malicious sites or phishing links that may host payloads; (3) memory access patterns in security logs if your organization captures detailed GPU driver events (uncommon). The most practical detection is version auditing to confirm all Chrome instances have been updated to 150.0.7871.115 or later. No specific IDS/IPS signatures will catch the graphics command itself.

Why prioritize this

This vulnerability warrants prompt patching despite a CVSS score of 6.5 (Medium) because: (1) memory disclosure attacks are difficult to detect post-exploitation; (2) the attack requires only user interaction and network access, making it practical for attackers; (3) Chrome's ubiquity means a large installed base is exposed; (4) the Chromium team's High severity classification reflects real-world risk even if CVSS doesn't fully capture it. Prioritize updates for users in roles handling sensitive data (finance, HR, legal, engineering).

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating driven by high confidentiality impact (C:H) but low attack complexity (AC:L) and no privilege requirements (PR:N). The score is reduced from a potential 7.5+ because user interaction is required (UI:R) and there is no integrity or availability impact. However, the real-world risk is elevated by Chrome's prevalence, the stealthy nature of memory disclosure, and the breadth of potential targets. Organizations should treat this as higher-priority than the numeric score alone suggests.

Frequently asked questions