CVE-2026-15114: Heap Corruption in Google Chrome Codecs – Patch Now

Technical summary

CVE-2026-15114 is a high-severity heap corruption vulnerability in Chrome's Codecs component. The defect involves improper bounds checking during video frame processing, allowing out-of-bounds memory access (CWE-125) and out-of-bounds write operations (CWE-787). When a user visits a website or downloads a crafted video file, the malicious content triggers the vulnerability during codec decompression, corrupting adjacent heap objects. This memory corruption can be leveraged to achieve code execution in the Chrome process context. The vulnerability requires user interaction (opening a video file or visiting a hostile webpage) but no additional privileges.

Business impact

Successful exploitation could grant attackers the ability to execute arbitrary code within the user's Chrome browser process, leading to credential theft, malware installation, or lateral movement into corporate networks. For organizations with Chrome as the primary or mandatory browser, this represents a significant attack surface. The user-interaction requirement lowers but does not eliminate risk—phishing campaigns distributing malicious video files or watering hole attacks remain viable. Delays in patching could leave users vulnerable during high-risk browsing sessions.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. This includes all platform variants (Windows, macOS, Linux) and all user profiles, whether personal or enterprise-managed. Organizations relying on Chrome for day-to-day operations should prioritize rapid inventory and patch deployment. Verify your deployed version against vendor release notes, as Chrome's auto-update mechanism may have already deployed patches in some environments.

Exploitability

The vulnerability has not been designated for the CISA KEV catalog, indicating no known active exploitation in the wild at the time of publication. However, the attack surface is broad: any user who opens an untrusted video file or visits a compromised website is at risk. The low attack complexity and lack of required privileges make this an attractive target for exploit development. Remote attackers can distribute malicious video payloads through email, messaging platforms, or compromised websites. Expect proof-of-concept or functional exploits to emerge within weeks if not already circulating in closed threat communities.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Enable automatic updates if not already active; Chrome's auto-update mechanism is generally reliable but should be verified in enterprise environments. For organization-managed Chrome deployments, use group policy or MDM solutions to enforce the patch version. Verify patch application post-deployment through the Chrome About menu (chrome://about) or programmatic device inventory tools. No workarounds exist; patching is the only remediation.

Patch guidance

Google Chrome delivers patches through its automatic update channel and via the Chrome Web Store. Users should navigate to Settings > About Chrome to trigger an immediate check for updates; the browser will prompt a restart to apply patches. Enterprise administrators managing Chrome through mobile device management (MDM) or group policy should verify deployment policies enforce the minimum version 150.0.7871.115 and monitor device compliance reports. For organizations using managed Chrome, explicitly set the minimum version requirement in your policy to prevent users from running older builds. Test patches in a pilot deployment before broad rollout if your organization operates under strict change control.

Detection guidance

Monitor process execution and system behavior for anomalous Chrome subprocess activity, particularly elevated privileges or unexpected child processes spawned by the browser. Network detection can identify malicious video files by their signatures or embedded payloads; however, custom or obfuscated video encodings may evade signature-based detection. Behavioral analytics should flag Chrome processes accessing system resources outside normal parameters. Endpoint Detection and Response (EDR) solutions should alert on heap spray attempts or repeated codec processing failures preceding a crash. Log Chrome crashes via your organization's crash-reporting infrastructure and correlate crash dumps with the CVE timeline to identify exploitation attempts.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (8.8), the combination of memory read and write primitives enabling reliable exploitation, and the broad attack surface presented by Chrome's ubiquity in enterprise and consumer environments. Although not yet on the KEV list, the recent publication date and lack of active exploitation disclosure should not delay remediation—such disclosures often precede public exploit availability. Organizations should prioritize Chrome patch deployment within 24–48 hours of validation.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: attack vector over the network (AV:N), low attack complexity due to straightforward codec processing (AC:L), no privilege escalation required (PR:N), user interaction needed to open a video (UI:R), limited scope to the Chrome process (S:U), and high impact across confidentiality, integrity, and availability (C:H, I:H, A:H). The out-of-bounds write capability elevates this beyond a simple information leak, enabling code execution and therefore the top-tier impact ratings. The user-interaction requirement prevents automatic exploitation via passive browsing, keeping the score below critical threshold.

Frequently asked questions