CVE-2026-15127: Chrome WebGL UXSS Vulnerability – Patch Guidance

Technical summary

CVE-2026-15127 stems from an inappropriate implementation in Chrome's WebGL subsystem that fails to properly sanitize or validate crafted HTML input. The vulnerability allows an unauthenticated remote attacker to achieve universal cross-site scripting (UXSS)—meaning injected scripts can bypass same-origin policies and access sensitive data or perform actions across different origins. The attack vector is network-based with low attack complexity and requires only user interaction (visiting a malicious page). The flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Organizations where employees use Chrome as their primary browser face risk of data theft, credential harvesting, and unauthorized account actions through UXSS attacks. While the CVSS base score is 6.1 (Medium), the ability to inject scripts across origins elevates practical risk—an attacker could exfiltrate session tokens, modify sensitive content, or perform transactions on behalf of the user. This is particularly concerning for financial services, healthcare, and government sectors relying on web applications for critical workflows.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes all Chrome installations on Windows, macOS, and Linux that have not been updated to or beyond version 150.0.7871.115. Mobile variants of Chrome and Chromium-based browsers (Edge, Opera, Brave, etc.) built on the same vulnerable code may also be affected; verify with each vendor's security advisories for specific version thresholds.

Exploitability

Exploitability is moderate to high in real-world scenarios. The attack requires no special privileges and can be delivered via a simple phishing link or compromised advertisement. However, it does require user interaction—the victim must visit the attacker's crafted webpage. No active exploitation has been observed in the wild at the time of this advisory's publication, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. The relatively low barrier to weaponization means the window for patch deployment should be treated as urgent.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Chrome typically auto-updates, but users should manually verify their version by navigating to Chrome Menu > Help > About Google Chrome. Enterprise deployments should push the update through their patch management systems. For organizations unable to update immediately, restrict user access to untrusted websites and enforce Content Security Policy (CSP) headers on internal web applications to mitigate XSS risks.

Patch guidance

Google has released Chrome 150.0.7871.115 containing the fix. Verify your current version under Settings > About. Most users on the automatic update channel will receive the patch within days; however, enterprise administrators managing Chrome through group policies should manually trigger deployment to ensure uniform coverage. Test patches in a staging environment before broad rollout to confirm no application compatibility issues.

Detection guidance

Monitor Chrome crash reports and plugin failures that may indicate exploitation attempts. Web application firewalls (WAFs) should be configured to detect and block suspicious WebGL requests or HTML injection payloads. Endpoint detection and response (EDR) tools can monitor for unexpected JavaScript execution or unusual network calls following Chrome page loads. Log analysis should focus on correlating user visits to untrusted domains with subsequent suspicious browser behavior. Consider implementing CSP reporting endpoints to catch injection attempts against your own web properties.

Why prioritize this

Although the CVSS score is Medium (6.1), the practical severity is elevated due to the universal XSS nature of the flaw, its network-based delivery, and the ubiquity of Chrome in enterprise environments. The lack of KEV listing does not diminish urgency—attackers typically wait for widespread deployment before public exploitation campaigns. Given Chrome's automatic update mechanism, patching should be a near-immediate priority for organizations with manual update policies or offline environments.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability requiring user interaction with low attack complexity. However, CVSS does not fully capture the cross-origin scripting capability (UXSS), which in practice allows attackers to overcome browser same-origin protections. The confidentiality and integrity impacts are rated as low because the attacker's access is limited to the user's session context, but for sensitive workflows (banking, healthcare, email) this translates to significant real-world risk. Organizations should treat this as a higher-priority fix than the base score alone suggests.

Frequently asked questions