CVE-2026-15121: Google Chrome WebRTC Use-After-Free Remote Code Execution (CVSS 8.8)

Technical summary

CVE-2026-15121 is a use-after-free (CWE-416) memory safety bug in the WebRTC engine of Google Chrome. The vulnerability arises when freed memory is incorrectly referenced during WebRTC processing, allowing an attacker to corrupt memory state and achieve arbitrary code execution. The flaw requires user interaction (visiting a malicious page) but no special privileges. The attack surface is network-accessible and the logic is not complex, resulting in a CVSS 3.1 score of 8.8 (HIGH). Exploitation occurs within Chrome's sandbox, which provides a containment layer but does not eliminate risk.

Business impact

Organizations relying on Chrome as a primary work browser face elevated risk of data exfiltration if employees visit compromised or attacker-controlled websites. The vulnerability could enable credential harvesting, session theft, or compromise of browser-stored sensitive data. For enterprises with strict browser policies, this creates urgency around patching before attackers develop reliable exploitation techniques. Supply-chain risk is also relevant if attackers target high-value organizations through watering-hole attacks.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes Chrome on Windows, macOS, Linux, and Android platforms. Chromium-based browsers that incorporate vulnerable WebRTC code before this patch version may also be affected; verify with individual vendors. Chrome users on automatic updates will receive the patch transparently, but organizations with manual update policies or airgapped environments must actively deploy the fix.

Exploitability

Exploitation requires user interaction (visiting a crafted HTML page), but no authentication or elevated privileges are necessary. The attack vector is network-accessible and the technical complexity is low. An attacker can craft malicious web pages, embed them in compromised sites, or distribute them via email or social engineering. The sandbox restriction limits post-exploitation impact compared to kernel-level vulnerabilities, but does not prevent it. Public exploitation is currently not tracked in the CISA KEV catalog, but given the HIGH severity rating and straightforward attack model, security teams should assume proof-of-concept code or limited targeted exploitation may emerge quickly.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. For Chrome users: enable automatic updates or manually check Help > About Google Chrome to trigger immediate patching. For enterprise environments: deploy the patch via your mobile device management (MDM) or endpoint management solution. Verify rollout completion before considering the vulnerability fully mitigated. Users on Chromium-based alternatives (Edge, Brave, Opera, etc.) should check vendor advisories for equivalent patched versions.

Patch guidance

Google has released Chrome 150.0.7871.115 as the stable patch version addressing this vulnerability. Organizations should prioritize this update for all users within 1–2 weeks, given the HIGH CVSS score and active attack surface. Test patch deployment in a small pilot group first if possible, though Chrome's sandbox architecture generally makes updates safe. For locked-down environments, verify the patch delivery mechanism (Google Update service, MDM policies, or manual installation) aligns with your update strategy. Document the patching timeline for compliance and audit purposes.

Detection guidance

Monitor Chrome version compliance across your environment using endpoint detection and response (EDR) tools or vulnerability scanning. Look for user-agent strings reporting Chrome versions below 150.0.7871.115 in web server and proxy logs. Endpoint agents should flag systems still running unpatched Chrome after a defined remediation window. Network-based detection is limited (the payload is obfuscated in HTML/JavaScript); focus on ensuring rapid patch adoption. No specific indicators of compromise are available at this time, but monitor for unusual WebRTC-related process behavior or memory corruption crashes in Chrome on systems still running vulnerable versions.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), network-accessible attack vector, low complexity, and requirement for only user interaction. The absence of KEV listing does not lower priority; CISA tracking lags behind active exploitation timelines. WebRTC is a pervasive feature in modern Chrome, and the use-after-free class of bug is frequently weaponized. Organizations should treat this as a P1 patching item and complete deployment within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible attack (AV:N), no special authentication or access control needed (PR:N), low attack complexity (AC:L), user interaction required (UI:R), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The sandbox scope mitigation (S:U, same scope) prevents direct privilege escalation beyond the browser process, but data compromise within that context is still severe. For an organization's risk model, this translates to high likelihood of exposure (many users visit the web daily) and significant potential impact (data theft, credential loss).

Frequently asked questions