CVE-2026-15120: Chrome Sandbox Escape via Use-After-Free (CVSS 8.3)

Technical summary

CVE-2026-15120 is a use-after-free condition (CWE-416) in Chrome's Core module affecting Windows versions prior to 150.0.7871.115. The vulnerability occurs when memory that has been freed is subsequently accessed, allowing an attacker controlling the compromised renderer process to manipulate object state and achieve code execution outside the sandbox boundary. The attack surface is network-accessible; exploitation requires crafted HTML delivered to a user, combined with a prior renderer compromise. The Chromium project assigned High severity, and the CVSS 3.1 score of 8.3 reflects the combination of network attack vector, high confidentiality and integrity impact, and scope change (breaking sandbox isolation).

Business impact

Successful exploitation could allow an attacker to gain system-level code execution on an affected Windows machine, bypassing Chrome's process isolation model. This represents a two-stage attack: first compromising the renderer (via malicious content, extension, or supply-chain attack), then leveraging this vulnerability to escape the sandbox. Organizations with users on vulnerable Chrome versions face elevated risk of malware deployment, credential theft, and lateral network movement from compromised endpoints.

Affected systems

Google Chrome on Microsoft Windows systems with versions prior to 150.0.7871.115 are affected. Chrome on other operating systems (macOS, Linux, Android) and earlier patch versions of Chrome 150 are not confirmed to be vulnerable based on available information. Verify your Chrome version via chrome://version and ensure you are running 150.0.7871.115 or later.

Exploitability

Exploitation requires two preconditions: (1) the attacker must have already compromised Chrome's renderer process, and (2) the victim must visit or interact with a crafted HTML page. While neither condition is trivial in isolation, the combination is feasible in targeted campaigns. The vulnerability is not listed on the CISA KEV catalog, suggesting active in-the-wild exploitation has not been publicly confirmed at the time of publication. The CVSS vector (AC:H—Attack Complexity High) acknowledges the renderer-compromise requirement, but the high impact score reflects the severity of sandbox escape.

Remediation

Update Google Chrome immediately to version 150.0.7871.115 or later. Chrome's auto-update mechanism should deploy patches automatically; users can manually check for updates via Settings > About > Google Chrome. Organizations should prioritize this update for high-risk users and enforce deployment via mobile device management or Group Policy. Because this vulnerability requires prior renderer compromise, defense-in-depth practices—blocking malicious downloads, sandboxing untrusted content, maintaining updated extensions—remain essential.

Patch guidance

Google Chrome version 150.0.7871.115 and later contain the fix. Verify patching via chrome://version. Auto-updates are enabled by default, but users should restart Chrome or wait for the scheduled update cycle. In enterprise environments, administrators can verify deployment via Chrome management console or by checking version numbers across enrolled devices. No manual configuration is required; the patch is transparent to end users.

Detection guidance

Monitor for Chrome renderer process crashes or unexpected terminations, which may indicate exploit attempts. Network detection should flag attempts to deliver malicious HTML to Chrome users, though this requires knowledge of payload signatures. Endpoint detection and response (EDR) tools should monitor for Chrome child processes spawning system-level executables or accessing sensitive system resources—a sign of successful sandbox escape. Log auth mechanisms for unusual lateral movement patterns originating from compromised workstations.

Why prioritize this

This vulnerability merits high priority for systems running vulnerable Chrome versions. Although active exploitation has not been confirmed in public threat intelligence, the combination of sandbox escape capability and moderate exploitability (requiring prior renderer compromise) makes it an attractive target for sophisticated threat actors. Windows systems are explicitly affected, and the scope change (breaking browser isolation) means successful exploitation has organization-wide impact, not just browser-level risk.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects four key factors: (1) network attack vector—the malicious HTML can be delivered remotely; (2) high confidentiality, integrity, and availability impact—system-level code execution; (3) scope change—the vulnerability breaks the boundary between the renderer sandbox and the Windows OS; and (4) attack complexity marked as high due to the requirement for prior renderer compromise. The score does not include user interaction burden in its severity calculation, though exploitation does require the user to visit a crafted page.

Frequently asked questions