CVE-2026-15116: Chrome Use-After-Free RCE – CVSS 8.8 High

Technical summary

CVE-2026-15116 is a use-after-free condition (CWE-416) in Chrome's Actor implementation. When improperly freed memory is accessed, an attacker can manipulate object state to achieve arbitrary code execution within the Chrome sandbox context. The vulnerability is reachable via network without authentication and requires only a user click on a crafted HTML page to trigger. Google has assigned this a High severity rating reflecting the ease of exploitation and the confidentiality, integrity, and availability impact it enables.

Business impact

Exploitation could result in unauthorized access to user data accessible within the Chrome process, modification of web content, execution of unwanted scripts, or use of the compromised browser as a staging point for lateral attacks. For organizations with strict web-browsing security policies, widespread unpatched Chrome instances increase risk of data exfiltration, credential theft, and supply-chain compromise via malicious web content.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable across all supported operating systems (Windows, macOS, Linux). This includes enterprise deployments where Chrome is used as a primary or secondary browser. Chrome's auto-update mechanism typically rolls out patches within hours to days, but organizations with managed deployments or update deferrals may have a longer exposure window.

Exploitability

Exploitability is straightforward: an attacker merely needs to host malicious HTML and socially engineer or advertise it to Chrome users. No advanced techniques, special network conditions, or user privilege escalation is required. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high exploitability with only user interaction as a barrier. Active exploitation in the wild has not been confirmed at time of publication, but the attack surface is large given Chrome's global user base.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. For enterprise environments, push the update through managed deployment channels (Chrome Enterprise, MDM solutions, or group policy) to ensure rapid coverage. Organizations unable to update immediately should consider restricting user browsing to trusted internal sites, using alternative browsers, or implementing additional sandbox/isolation controls.

Patch guidance

Verify that Chrome has auto-updated to 150.0.7871.115 or higher by navigating to Chrome Settings > About Google Chrome, which will display the installed version. For managed environments, confirm patch deployment through your MDM or Chrome management console. Test patch application on a representative sample of endpoints before full rollout if using deferred or phased updates. No manual configuration changes are required; the security fix is included in the version update itself.

Detection guidance

Monitor for Chrome crash dumps or sandbox escapes that may indicate exploitation attempts. Log browser version information across endpoints to identify machines still running vulnerable versions. In network-based detection, look for suspicious HTML pages hosting obfuscated JavaScript or abnormal memory-access patterns if deep packet inspection is available. Endpoint detection and response (EDR) tools should flag unexpected child processes spawned from Chrome that may signal sandbox escape.

Why prioritize this

This vulnerability warrants immediate attention because it combines high exploitability (network-reachable, low user interaction barrier), severe impact (full code execution), and a global attack surface (billions of Chrome users). The use-after-free class of vulnerability is well-understood and reliably exploitable. Although not yet listed in known exploited vulnerabilities (KEV), the combination of ease and reward makes active exploitation likely within weeks if unpatched instances remain prevalent.

Risk score, explained

The CVSS 8.8 HIGH score reflects the network attack vector, low complexity, requirement only for user interaction, high impact on confidentiality/integrity/availability, and lack of scope change. This places the vulnerability in the upper tier of severity for client-side browsers. The score does not account for sandbox mitigation (Chrome's sandbox does contain some damage), but escape to the host OS is theoretically possible with additional vulnerabilities or misconfigurations.

Frequently asked questions