CVE-2026-15125: Chrome Forms Code Execution Vulnerability

Technical summary

CVE-2026-15125 is rooted in an inappropriate implementation of the Forms component in Chromium. The flaw involves improper handling of form-related operations that fails to properly enforce sandbox boundaries. The vulnerability is classified under CWE-863 (Incorrect Authorization), indicating that the Forms code does not correctly verify permissions before executing operations. An attacker can craft a malicious HTML page that, when loaded by a victim, triggers the vulnerability and executes arbitrary code within the Chrome sandbox—bypassing the normal isolation protections the sandbox is designed to provide.

Business impact

For organizations where employees use Chrome as their primary browser, this vulnerability creates risk of code execution on workstations. While the sandbox limit contains the immediate impact to the Chrome process itself (preventing direct system compromise), attackers could exfiltrate sensitive data from the browser, steal authentication credentials, or use the compromised browser as a pivot point for lateral movement. For environments managing large Chrome fleets—whether through corporate deployment or BYOD policies—the user-interaction requirement and high execution likelihood make this a meaningful business risk requiring prompt patching.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes Chrome on Windows, macOS, and Linux. Chromium-based browsers and Chrome derivatives may also be affected depending on their version relative to the patched Chromium version. Organizations should check Chrome version across all endpoints using `chrome://version/` or equivalent inventory tools.

Exploitability

The vulnerability requires user interaction (opening or interacting with a crafted HTML page) but is otherwise accessible to a remote attacker without authentication. No special network conditions are required. The attack vector is network-based and the barrier to delivering the malicious page is low—such pages can be hosted on attacker infrastructure or injected into compromised legitimate websites. The CVSS score of 8.8 reflects the combination of remote accessibility, low complexity, user interaction requirement, and high impact on confidentiality, integrity, and availability.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Chromium also released the same fix in its corresponding version. Organizations should prioritize this patch, particularly for users who visit untrusted websites or receive email with links. Enable automatic Chrome updates where possible to reduce manual deployment overhead. For managed Chrome environments, deploy via your endpoint management platform (MDM/EMM).

Patch guidance

Google Chrome auto-updates are enabled by default on most installations. Users can verify their version at chrome://version/ and update via Menu → Help → About Google Chrome, which will check for and download available patches. For enterprise Chrome deployments, use your organization's Chrome management or MDM solution to push version 150.0.7871.115 or later across the fleet. Verify deployment completion within 7 days of patch availability. Chromium-based browsers (Edge, Brave, Vivaldi, etc.) should check their respective release notes for the corresponding patched version.

Detection guidance

Look for Chrome crashes, unexpected browser process restarts, or unusual child process spawning from the Chrome executable. Monitor for users accessing suspicious or unusual HTML content in browser history. Endpoint Detection and Response (EDR) tools should flag any attempt to execute code spawned from the Chrome renderer process. Browser isolation tools may log attempted sandbox escapes. These signals are correlative rather than definitive; prioritize patching as the primary control rather than relying on detection of active exploitation.

Why prioritize this

This is a high-severity remote code execution vulnerability affecting a ubiquitous desktop application. The user-interaction requirement moderates urgency slightly, but the combination of network accessibility, high-impact compromise, and widespread use of Chrome in enterprise and consumer environments makes this a critical patch. The fact that it is not yet in CISA's Known Exploited Vulnerabilities (KEV) catalog does not indicate low risk—it reflects publication timing, not threat level.

Risk score, explained

The CVSS 8.8 HIGH score is justified by the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. All three impact metrics (Confidentiality, Integrity, Availability) are rated High, indicating potential for data theft, code injection, and process denial. The attack requires only network access with low complexity; user interaction is the primary mitigation. The sandbox scope constraint (S:U) limits the blast radius to the browser process, preventing immediate OS-level compromise, which is why the score is 8.8 rather than 9.0+. For most organizations, this warrants urgent patching within 7 days.

Frequently asked questions