CVE-2026-15117: Chrome Use-After-Free in Payments Feature (High CVSS 7.5)

Technical summary

CVE-2026-15117 is a use-after-free vulnerability (CWE-416) in Google Chrome's Payments subsystem. The flaw occurs when the browser attempts to access memory that has already been freed, creating a window for heap corruption. The vulnerability is reachable via a remote, network-based attack vector requiring no special privileges, but user interaction is necessary—specifically, the victim must perform particular UI gestures on a page controlled by the attacker. Successful exploitation could lead to arbitrary code execution through heap corruption. Google has assigned this a High security severity rating within the Chromium security framework.

Business impact

Organizations relying on Chrome as a primary browser face potential risk to employee workstations and data security. An attacker exploiting this vulnerability could gain unauthorized access to sensitive information processed within the browser, including credentials, financial data, or confidential communications. In environments where browser-based payment systems or transaction processing occurs, successful exploitation could compromise the integrity of those transactions. The requirement for user interaction somewhat limits attack scalability, but targeted campaigns against specific employees remain feasible. Patching delays increase exposure window and risk of supply-chain or targeted exploitation.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected across all operating systems that Chrome supports. The vulnerability resides in the Payments feature, which is active by default in Chrome. Any user running an unpatched version of Chrome prior to 150.0.7871.115 is potentially vulnerable if they visit a malicious or compromised website and perform the required UI interactions. This includes both consumer users and enterprise deployments where Chrome is utilized.

Exploitability

Exploitation requires moderate attacker sophistication. The attacker must craft a malicious HTML page and execute a social engineering attack to convince a user to perform specific UI gestures. This is not a one-click exploit; it demands deliberate user action in response to attacker-controlled content. However, the attack surface is broad—any website visit could be weaponized. Once the preconditions are met (user interaction on the malicious page), the vulnerability can trigger heap corruption, which may lead to code execution. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting limited or no active wild exploitation at this time, though this does not eliminate risk.

Remediation

Users and administrators must update Google Chrome to version 150.0.7871.115 or later. Chrome's automatic update mechanism should deliver the patch; verify the update has completed by navigating to Chrome menu > About Google Chrome, where the browser will check for and install updates. In enterprise environments, use Chrome administration policies to enforce timely updates and restrict users from postponing updates indefinitely. For organizations requiring version pinning or staged rollouts, coordinate patch timing with Chrome's release schedule and test for any compatibility issues within your environment.

Patch guidance

Update to Google Chrome 150.0.7871.115 or newer. Verify the installed version in Chrome settings (chrome://settings/help). If auto-update is disabled in your environment, manually trigger updates via the browser or use Google's admin console to push the patch to managed devices. Test the patch in a non-production environment first if your organization has legacy web applications relying on Chrome. No manual workarounds or mitigation steps can fully prevent exploitation; patching is the definitive remediation.

Detection guidance

Monitor for exploitation attempts by logging network traffic to known malicious domains hosting exploit pages. Endpoint detection and response (EDR) tools should flag unusual process execution or memory corruption patterns originating from Chrome processes. Web content filters can block access to known malicious or compromised sites. On the host level, monitor Chrome process behavior for unexpected memory allocation or child process creation. Intrusion detection systems may detect network traffic patterns associated with delivering the malicious HTML payload, though such detection is limited to network-based indicators. Application crash logs and core dumps from Chrome may indicate exploitation attempts; correlate these with user reports of browser crashes on specific dates or websites.

Why prioritize this

This vulnerability merits immediate patching due to the combination of a high CVSS score (7.5), potential for code execution via heap corruption, and the ubiquitous use of Chrome in enterprise and consumer environments. While active exploitation is not yet documented in public databases, the attack surface is broad and the barrier to social engineering users is relatively low. The Payments feature touches financially sensitive operations, elevating business risk. The High severity designation from Google and the ease of weaponization via malicious webpages justify rapid deployment of the patch across your estate.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability requiring user interaction but offering high impact across confidentiality, integrity, and availability. The score accounts for the difficulty of reliably triggering the use-after-free condition (hence the AC:H modifier) and the need for specific UI gestures. While not a critical 9.0+, the combination of remote reachability, heap corruption potential, and widespread Chrome deployment elevates this beyond routine vulnerabilities. The absence of a required privilege level and the default-enabled Payments feature further support the high severity designation.

Frequently asked questions