CVE-2026-15122: Chrome Sandbox Escape via Codec Validation Flaw

Technical summary

CVE-2026-15122 is a sandbox escape vulnerability in Google Chrome's codec validation layer. The root cause is insufficient input validation in codec processing logic running within the renderer process. An attacker with code execution in the renderer sandbox can craft a malicious HTML page that triggers improper codec handling, bypassing sandbox restrictions and executing arbitrary code with the privileges of the Chrome process (which typically runs with user-level permissions). The vulnerability is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 8.3 (High), reflecting the requirement for partial attacker control and user interaction, combined with severe impact potential.

Business impact

A successful exploit could grant an attacker complete control over an affected system, including access to sensitive files, credentials, and the ability to install malware or establish persistence. For organizations, this is particularly concerning because it requires only that a user visit a compromised or attacker-controlled website while using a vulnerable version of Chrome. Remote workers, contractors, and any employee browsing the internet are at risk. The impact extends beyond the individual user to potential lateral movement within networks and data exfiltration.

Affected systems

Google Chrome on Microsoft Windows is affected. The vulnerability was patched in Chrome version 150.0.7871.115 and later. All versions of Chrome on Windows prior to this release are vulnerable, regardless of operating system version. Other platforms (macOS, Linux, Android) are not mentioned in the advisory and should be verified against Google's official security release notes. Enterprise deployments using older Chrome versions or those with delayed update cycles face the greatest exposure.

Exploitability

The attack requires two preconditions: (1) the renderer process must be compromised, typically through a prior vulnerability or social engineering, and (2) the user must interact with a crafted HTML page, usually by visiting a malicious website. While these prerequisites make exploitation more complex than a simple one-click attack, they are not insurmountable in real-world scenarios. Once a renderer is compromised (which itself is not uncommon in active exploitation chains), this sandbox escape significantly raises the impact. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but its high severity and sandbox-escape nature make it an attractive target for sophisticated threat actors.

Remediation

Organizations should immediately prioritize updating Google Chrome to version 150.0.7871.115 or later on all Windows systems. This can be enforced through enterprise deployment tools (Google Admin Console, third-party mobile device management, or configuration management systems) or Windows Update if Chrome is configured to auto-update. Ensure that automatic updates are enabled and that users cannot disable security updates. Additionally, implement application whitelisting or sandboxing policies that restrict execution of untrusted content, and educate users to avoid visiting untrusted websites or clicking suspicious links.

Patch guidance

Google has released Chrome 150.0.7871.115 as the stable channel release addressing this vulnerability. Verify the exact version number via Google's official Chrome release notes and your organization's patch management system. For Chrome Enterprise deployments, use the Google Admin Console to push updates and track rollout status. Consumer users should check Settings > About Chrome to trigger an automatic update. After patching, verify that systems have rebooted (if required) and that running Chrome instances are using the patched version. Test that business-critical websites and extensions continue to function normally post-patch.

Detection guidance

Monitor for Chrome process crashes or unexpected restarts, which may indicate exploitation attempts. In network logs, look for unusual outbound connections from systems running Chrome after visiting new or untrusted domains. Endpoint detection and response (EDR) tools should flag attempts to break out of browser sandboxes, such as suspicious system calls or privilege elevation from chrome.exe. Check Windows Event Viewer for abnormal process creation tied to Chrome, and review web gateway logs for access to known malicious sites. Version reporting through asset management tools will help identify which systems remain unpatched.

Why prioritize this

This vulnerability merits immediate priority because sandbox escapes in widely-used browsers represent a critical escalation path for attackers. While the initial compromise of the renderer process is a prerequisite, the existence of a reliable sandbox-escape chain significantly increases the value of prior renderer exploits to attackers. Google's High severity rating and the broad Windows user base make this a key risk to address quickly. Organizations with delayed patching cycles or high volumes of Windows Chrome users should treat this as a top-5 remediation item.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects a High severity due to high confidentiality, integrity, and availability impact if exploited, but the score is moderated by the requirement for user interaction (UI:R) and high attack complexity (AC:H), as both renderer compromise and user-triggered payload delivery are needed. The network vector (AV:N) indicates remote exploitability, and the changed scope (S:C) shows that impact extends beyond the vulnerable component. Organizations should interpret this as 'very serious' rather than 'critical' — urgent patching is warranted, but this is not a 9.x-level outbreak scenario.

Frequently asked questions