CVE-2026-15118: Chrome Use-After-Free in Input Component – Patch Guidance

Technical summary

CVE-2026-15118 is a use-after-free vulnerability (CWE-416) in Google Chrome's Input handling. The flaw allows a network-based attacker without requiring special privileges to craft HTML content that induces a freed memory access condition. Successful exploitation results in arbitrary code execution within the Chrome sandbox; the attack requires user interaction (opening a malicious web page) but has no other access control barriers. Chromium's security team assessed this as High severity, and CVSS 3.1 rating of 8.8 reflects the critical combination of network attack vector, low complexity, required user interaction, and high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses significant risk to organizations and users who rely on Chrome for web browsing and web application access. An attacker can compromise user sessions, steal sensitive data, install malware, or pivot to internal systems if the affected browser has network access. For enterprises, this is especially concerning if users visit untrusted or compromised websites. The sandbox containment limits full system compromise, but sandbox escapes are a known avenue of further exploitation. Organizations should prioritize patching to prevent user credential theft and malware installation.

Affected systems

Google Chrome releases prior to version 150.0.7871.115 are vulnerable. This includes all older versions across Windows, macOS, Linux, Android, and iOS platforms. Organizations running Chrome in enterprise environments, or supporting user-managed Chrome installations, should inventory their Chrome version distribution to identify exposure.

Exploitability

Exploitation requires a user to visit a attacker-controlled or compromised website containing malicious HTML. The attack is relatively straightforward from a user perspective—no special browser configuration or user error beyond visiting a webpage is needed. The low complexity and lack of privilege requirements make this a practical threat in the wild. However, exploitation is not wormable or self-propagating; it depends on user browsing behavior. The CVSS user interaction requirement reflects this practical constraint.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. This patch addresses the use-after-free condition in the Input component. Chrome's auto-update mechanism will deliver the patch automatically on most platforms, but users and administrators should verify that the update has been applied, especially in enterprise environments where auto-update may be disabled or managed.

Patch guidance

Users: Enable automatic updates in Chrome settings (default behavior on most platforms) and verify the browser version in Chrome menu > About Google Chrome—the browser will report the current version and automatically download patches. Administrators: Verify that Chrome update policies are applied (via Chrome Enterprise, mobile device management, or native OS updates), and confirm deployed version through inventory or endpoint management tools. Test patch deployment in a non-production environment if managing centralized Chrome deployment. Verify against official Google Chrome release notes for confirmation that version 150.0.7871.115 or later is in use.

Detection guidance

Monitor for browser crashes or unexpected code execution on endpoints running Chrome, particularly if correlated with user browsing activity to external websites. Endpoint Detection and Response (EDR) tools should flag process creation anomalies from the Chrome sandbox process. Network detection is challenging since the exploit is delivered via standard HTTP/HTTPS; behavioral indicators include unusual child processes spawned from the Chrome sandbox or memory access violations within Chrome's process space. Security teams should review browsing telemetry or firewall logs if users visited known malicious sites before the patch date. Web application firewalls cannot easily block this attack since the malicious payload is in legitimate HTML.

Why prioritize this

This vulnerability merits high priority patching due to its CVSS score of 8.8, practical exploitability (network-based, user interaction only), and widespread impact across Chrome's user base. The use-after-free flaw in core input handling suggests the vulnerability is likely in commonly-used code paths. Although the sandbox provides containment, the severity of in-sandbox code execution combined with the ease of delivery via web pages makes this a clear and present risk. Organizations should patch within 1–2 weeks of release, with higher urgency for enterprises where users frequently access untrusted websites.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) is driven by: AV:N (network-based attack), AC:L (low complexity, no special conditions needed), PR:N (no privileges required), UI:R (user interaction required—user must open malicious page), S:U (impact is limited to the vulnerable component/sandbox), and C:H/I:H/A:H (high impact on all three security properties within the sandbox). The score reflects a critical vulnerability that is easy to exploit and has severe consequences for affected users, though sandbox isolation prevents system-wide compromise. The use-after-free condition is a fundamental memory safety flaw with a well-understood attack surface.

Frequently asked questions