CVE-2026-15112: Critical Use-After-Free in Google Chrome Ozone – Patch to 150.0.7871.115

Technical summary

CVE-2026-15112 is a use-after-free vulnerability (CWE-416) in Chrome's Ozone subsystem, which handles display and input on Linux and ChromeOS platforms. The defect allows a remote, unauthenticated attacker to craft HTML that references a memory object after it has been freed, leading to heap corruption. The Chromium project rated this as Critical severity. The CVSS 3.1 score of 8.8 (HIGH) reflects the network attack vector, low attack complexity, lack of privilege or user interaction requirements beyond clicking a link, and high impact across confidentiality, integrity, and availability.

Business impact

Exploitation could allow attackers to steal browser-resident credentials, session tokens, or other sensitive data from compromised users. In targeted scenarios, heap corruption might enable code execution within the Chrome sandbox, potentially cascading to system compromise. Organizations relying on Chrome as a primary browser face risk to data confidentiality and business continuity if users are exposed to drive-by attacks on compromised or attacker-controlled websites. The attack requires no social engineering beyond normal web browsing.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. The Ozone component is primarily active on Linux and ChromeOS environments; Windows and macOS users running affected Chrome versions may experience different attack surface exposure. All users of unpatched Chrome instances are at risk if they visit or are redirected to a malicious page.

Exploitability

This is a network-based exploit with low attack complexity. An attacker needs only to host a crafted HTML page and trick or redirect a user to visit it—no advanced social engineering, file downloads, or privilege escalation is required. However, reliable heap exploitation for remote code execution is typically difficult; attacks may reliably cause denial of service (crash) with less effort than code execution. The lack of KEV (Known Exploited Vulnerability) designation as of the publication date suggests no widespread in-the-wild exploitation has been documented, but the low barrier to attack delivery means exploitation could emerge quickly.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Updates are typically delivered automatically, but users can manually check Settings > About to trigger installation. Organizations should verify automatic update policies are enabled and monitor deployment across endpoints. For systems unable to update immediately, restrict Chrome usage or employ network controls to block access to untrusted websites.

Patch guidance

Google has released Chrome 150.0.7871.115 as the fixed version. Verify this version number or later in Chrome Settings > About > Chrome. Automatic updates are the default delivery mechanism; ensure your update channel is not disabled by policy or configuration. For enterprise deployments, confirm your managed Chrome policies are set to auto-update and validate successful rollout across your fleet within 24–48 hours.

Detection guidance

Monitor for Chrome crashes or unusual process termination, especially on Linux and ChromeOS systems. Endpoint detection tools may flag heap corruption patterns or unusual memory access in Chrome processes, though this is subtle. Network-level detection is difficult without analyzing traffic to malicious domains; focus on keeping Chrome updated and using security tools that flag known malicious sites. Log Chrome version numbers across your environment to identify unpatched instances.

Why prioritize this

This vulnerability warrants immediate patching due to its high CVSS score (8.8), network attack vector, and the absence of authentication or complex user interaction. The use-after-free defect in a core browser component presents real confidentiality and integrity risk. Although not yet in the KEV catalog, the low complexity of attack delivery means malicious actors may develop or deploy exploits rapidly. Prioritize updates to 150.0.7871.115 for all Chrome users, especially those on Linux/ChromeOS and those who browse untrusted sites.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network attack vector—no local access required, (2) Low attack complexity—a simple HTML page suffices, (3) No authentication or privilege escalation needed, (4) User interaction required (visiting a link) but low-friction, and (5) High impact to all three CIA triad elements if heap corruption is successfully exploited. The score would be higher (9.8+) if user interaction were not required; it is lower than Critical partly because reliable exploitation to code execution is non-trivial, though denial-of-service is straightforward.

Frequently asked questions