CVE-2026-15123: Critical Google Chrome DOM Heap Corruption Vulnerability (v150.0.7871.115 Patch)

Technical summary

CVE-2026-15123 is a heap corruption vulnerability in Chrome's DOM implementation. The issue stems from inappropriate handling of DOM objects in memory, tracked as CWE-122 (Heap-based Buffer Overflow). When a specially crafted HTML page is processed, it can trigger out-of-bounds memory writes, corrupting heap structures. An attacker can exploit this remotely by serving the malicious HTML to a user's browser. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-based attack, low attack complexity, requirement for user interaction, and full impact on confidentiality, integrity, and availability. Chromium security classified this as High severity.

Business impact

Exploitation could expose sensitive user data, modify displayed content, or cause browser instability. In enterprise environments, this could facilitate credential theft, session hijacking, or malware delivery if employees visit compromised or attacker-controlled sites. The vulnerability is not currently being actively exploited in the wild according to CISA data, but its high CVSS score and public disclosure warrant prompt patching to reduce attack surface.

Affected systems

Google Chrome browser versions prior to 150.0.7871.115 are vulnerable. This includes all earlier releases of Chrome 150 and Chrome 149 and earlier. Desktop and mobile Chrome installations are affected. Chromium-based browsers that incorporate unpatched versions of the affected code may also be vulnerable; verify your specific Chromium derivative's patch status with the vendor.

Exploitability

The vulnerability requires a user to visit a malicious webpage, making social engineering or drive-by downloads the likely delivery method. An attacker does not need special network privileges or system access. Attack complexity is low, and no authentication is required. However, this is not a wormable vulnerability—it cannot self-propagate. The current KEV (Known Exploited Vulnerabilities) catalog does not list active exploitation, but public CVE disclosure and technical details increase the likelihood of exploit development over time.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Chrome's auto-update mechanism will deploy patches automatically, but users can manually check Settings > About Chrome to force an immediate update check. Once updated, Chrome will restart automatically. For Chromium-based browsers, follow the vendor's advisory for patched versions.

Patch guidance

1. Navigate to chrome://settings/help or use Menu > Settings > About Chrome. 2. Chrome will check for updates and display the version number. 3. If an update is available (150.0.7871.115 or higher), click 'Relaunch' to apply it. Some systems require a system reboot. 4. For enterprise deployments, use Chrome administrative policies to enforce automatic updates via your device management solution (Google Admin, Intune, or equivalent). 5. Verify your version in chrome://version to confirm the patch is applied. 6. Note: Check that any Chromium-based derivative applications (Edge, Brave, Vivaldi, etc.) are also updated, as they may use shared Chromium code.

Detection guidance

Monitor for Chrome version compliance in your environment using endpoint management tools (Jamf, Intune, Workspace ONE). Log network traffic for suspicious attempts to deliver crafted HTML (review DNS/proxy logs for visits to newly registered or suspicious domains). Monitor browser crash logs and debug information for heap corruption indicators (segmentation faults, unhandled exceptions in DOM parsing). In security operations, correlate user browsing patterns with simultaneous anomalous process spawning or credential theft reports. No signatures exist for the vulnerability itself in network-based IDS/IPS, so focus on deployment and behavioral anomalies.

Why prioritize this

This vulnerability merits immediate patching (within 1–2 weeks) due to: (1) High CVSS score (8.8) reflecting full compromise potential; (2) Low attack barrier—only user interaction required; (3) Public disclosure with technical details, increasing exploit development likelihood; (4) Ubiquity of Chrome across workforces, making it a high-value target. Although not yet actively exploited, the combination of severity and ease of weaponization justifies elevated priority. Organizations with high-risk users (executives, researchers, public-facing staff) should prioritize first.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low complexity, user interaction requirement, and complete impact on confidentiality, integrity, and availability. The absence of KEV listing slightly reduces immediate risk, but public disclosure and technical exploitability warrant treating this as high-priority. The risk is modulated by the user-interaction requirement; passive browsing is safe, but visiting untrusted sites or clicking links in emails from unknown senders becomes dangerous.

Frequently asked questions