CVE-2026-15126: Chrome Use-After-Free in Forms Leads to Sandbox Code Execution

Technical summary

CVE-2026-15126 is a use-after-free vulnerability (CWE-416) in the Forms subsystem of Google Chrome. Use-after-free occurs when a program accesses memory that has already been freed, potentially allowing attackers to corrupt heap state or hijack control flow. In this case, the flaw resides in Chrome's Forms handling code and can be triggered by a maliciously crafted HTML page. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and authenticity impact, with network-based attack vector, low attack complexity, and no privilege requirement—though user interaction (clicking a link or visiting a site) is required. Sandbox escape is not indicated; exploitation results in code execution within the Chrome sandbox.

Business impact

An attacker exploiting this vulnerability could steal sensitive data accessed through the browser—including authentication tokens, personal information, or corporate credentials—or inject malware into the user's browsing session. For enterprises, this creates risk across the workforce wherever Chrome is used for web-based applications, email, or internal tools. The sandbox containment limits system-wide compromise but does not eliminate exfiltration or privilege-escalation risks. Delayed patching increases exposure window for both targeted spear-phishing attacks and opportunistic malware distribution via compromised websites.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes Chrome on Windows, macOS, Linux, and Chrome OS. Chromebook users, heavy Chrome users in corporate environments, and any endpoint running an unpatched Chrome release are at risk. Verify your organization's Chrome deployment version and update policy coverage.

Exploitability

Exploitation requires user interaction—a victim must visit or be directed to a malicious webpage. Attack complexity is low, and no special privileges are needed on the target system. The attack vector is network-based, making it deliverable via phishing emails, watering-hole attacks, malvertising, or compromised legitimate websites. Given the prevalence of social engineering and the ease of embedding malicious forms in webpages, this vulnerability presents moderate-to-high real-world exploitability. However, it is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active weaponization may be limited at this time.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Chrome's automatic update mechanism should deploy the patch automatically within hours or days depending on your OS and deployment. Users on managed devices (via Workspace, Mobile Device Management, or enterprise Chrome policies) may need to verify that updates are not blocked by organizational policies. Test the patched version in a non-critical environment first if your organization requires change control.

Patch guidance

Verify the exact version of Chrome running on your endpoints using chrome://version in the address bar or via remote inventory tools. If version 150.0.7871.115 or later is not present, initiate an immediate update. Chrome auto-updates are typically applied on restart, so communicate with users to restart their browsers or devices. For large deployments, use Google Chrome Enterprise policies to enforce the minimum required version and disable older releases via the 'MinimumChromeVersion' or update management tools. Monitor the Google Chrome Releases blog (chromereleases.googleblog.com) for confirmation of the fix landing in the stable channel.

Detection guidance

Network-based detection is challenging since the attack relies on a user visiting a crafted webpage. Focus on behavioral indicators: monitor for unexpected child processes spawned by Chrome, unusual network connections from the browser process, or credential-related logs immediately following suspicious browser activity. Endpoint Detection and Response (EDR) tools should flag use-after-free exploitation attempts via memory corruption signatures or heap manipulation patterns. Log browser history and visited URLs on managed devices to correlate with incident timelines. Consider blocking known malicious domains via web gateways and deploying Chrome policies to restrict extensions and disable dangerous features in high-risk environments.

Why prioritize this

This vulnerability warrants immediate prioritization due to its high CVSS score (8.8), the low attack complexity, ease of weaponization through standard web delivery, and the ubiquity of Chrome in modern organizations. Although not yet on the KEV list, the combination of sandbox-level code execution, zero user privilege requirement, and straightforward exploitation path make it a prime target for attackers. The fix is mature and readily available, making rapid deployment both feasible and critical.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network attack vector (AV:N) — exploitable from any internet-connected network without special access; (2) low attack complexity (AC:L) — no advanced techniques or race conditions needed; (3) no privilege requirements (PR:N) — victim account privileges are irrelevant; (4) user interaction required (UI:R) — user must visit the malicious page, reducing automated mass exploitation but not preventing targeted spear-phishing; (5) scope unchanged (S:U) — impact is confined to the Chrome process and sandbox; (6) high confidentiality impact (C:H) — attacker can read sensitive data in the browser context; (7) high integrity impact (I:H) — attacker can modify data or inject malicious content; (8) high availability impact (A:H) — attacker can crash the browser or cause denial of service. The score is not CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (which would be 9.8) only because user interaction is required to trigger the vulnerability.

Frequently asked questions