CVE-2026-15110: Google Chrome Use-After-Free in Extensions (CVSS 8.8)

Technical summary

CVE-2026-15110 is a use-after-free vulnerability (CWE-416) in the Extensions subsystem of Chromium/Google Chrome. The flaw allows an attacker to craft a malicious Chrome extension that, when loaded, causes the browser to reference memory that has already been freed. This heap corruption can lead to arbitrary code execution with the privileges of the Chrome process. The vulnerability was assigned a CVSS v3.1 score of 8.8 (High severity) with a network-exploitable attack vector and low attack complexity, though it requires user interaction to install the extension. The Chromium project classified this as High severity and addressed it in Chrome 150.0.7871.115 and later.

Business impact

Organizations should assess whether users have permission to install arbitrary extensions, as this directly determines organizational risk. For enterprises with strict extension policies, the impact is significantly reduced. However, for organizations where users install extensions freely—such as remote workers using personal extension collections or small teams without endpoint controls—successful exploitation could lead to data exfiltration, malware installation, or lateral movement within the corporate network. The attack requires social engineering to convince users to install the malicious extension, which may target high-value individuals or use convincing packaging to lower suspicion.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. This includes all versions from the initial Chrome release through 150.0.7871.114. Users on the stable, beta, dev, and canary channels running vulnerable versions are at risk, as are users of Chromium-based browsers that have not yet merged this patch. Enterprise deployments using managed Chrome installations should check their current version against 150.0.7871.115 to determine exposure.

Exploitability

While the underlying memory corruption is a high-severity flaw, real-world exploitation requires social engineering to convince a user to install a malicious extension. The attacker cannot trick the browser into loading an unsigned or unpacked extension without explicit user action. However, attackers could distribute malicious extensions via third-party marketplaces, phishing campaigns, or by compromising legitimate extension developer accounts. Once installed, the extension has broad access to browser memory and can trigger the use-after-free condition. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, but the technical simplicity of use-after-free exploitation means weaponization is straightforward once a working proof-of-concept is developed.

Remediation

Users should upgrade to Google Chrome 150.0.7871.115 or later immediately. Enterprises should validate their deployed Chrome version across managed devices and enforce an automatic update policy if not already in place. Additionally, review extension policies: disable user installation of arbitrary extensions via group policy (ExtensionInstallBlocklist / ExtensionInstallAllowlist) or security configuration tools. Audit currently installed extensions across the organization and remove any that are not business-critical or from untrusted developers. For users who must use extensions, prioritize those from well-known, actively maintained sources.

Patch guidance

Google released Chrome 150.0.7871.115 and subsequent versions containing the fix. Verify your Chrome version by navigating to chrome://settings/help, which will display the installed version and automatically apply available updates. For enterprise deployments, use your configuration management system to enforce version 150.0.7871.115 or later. Test the patch in a staging environment before mandatory deployment to ensure compatibility with business-critical extensions. Users on older Chrome release channels should switch to the stable channel if possible, as security updates are rolled out most reliably there.

Detection guidance

Monitor endpoint logs for unusual extension installation events, particularly installations from outside the official Chrome Web Store or unsigned extensions. Review Chrome extension audit logs if your organization uses Chrome Enterprise or cloud management policies. Look for unexpected processes spawned by the Chrome process with elevated privileges, which could indicate successful exploitation. Browser crash logs or segmentation faults in Chrome processes may indicate attempted use-after-free exploitation. In network monitoring, watch for extensions attempting unusual outbound connections shortly after installation. Implement user awareness training to recognize social engineering attempts targeting extension installation.

Why prioritize this

This vulnerability merits rapid patching because it combines high technical severity (CVSS 8.8, arbitrary code execution potential) with a major attack surface (billions of Chrome users globally). Although exploitation requires user interaction, the ubiquity of Chrome and the ease of social engineering around extension installation make this a practical threat. Organizations with less mature extension governance should prioritize this remediation alongside their critical OS and application patching cycles.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects the high severity: arbitrary code execution is possible (confidentiality, integrity, and availability impact all marked as High), attack complexity is low once a malicious extension is installed, and the attack requires only network access and user interaction. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-accessible, low-complexity vulnerability with user interaction required and no privilege escalation required. The score would be higher (approaching critical) if the vulnerability did not require convincing a user to install the extension; the user interaction requirement prevents it from reaching the 9.0+ critical threshold.

Frequently asked questions