CVE-2026-15129: Critical Use-After-Free in Google Chrome Views Component

Technical summary

CVE-2026-15129 is a use-after-free vulnerability (CWE-416) in the Views subsystem of Google Chrome. Use-after-free bugs occur when a program references memory that has already been freed, potentially allowing an attacker to overwrite freed heap memory with malicious data. In this case, the flaw resides in Chrome's Views rendering layer and can be exploited through a specially crafted HTML page delivered over the network. Successful exploitation leads to heap corruption, which an attacker can leverage to execute arbitrary code with the privileges of the Chrome process. The Chromium security team assigned this a Critical severity rating internally.

Business impact

Organizations where Chrome is the primary or standard browser face direct risk. A successful exploit could compromise employee workstations, enabling credential theft, lateral movement, malware installation, or data exfiltration. This is particularly concerning in environments where users browse untrusted content—including those relying on web-based SaaS applications—since the attack requires only viewing a malicious page. The lack of KEV inclusion (as of the publication date) suggests active exploitation may not yet be widespread, but the ease of delivery and severity of impact make this a high-priority patch scenario.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes all Windows, macOS, and Linux deployments running older versions. Organizations using Chrome as part of their standard image or those with auto-update disabled are at elevated risk. Chromebook and Chrome OS devices are also affected if they have not received the latest security update.

Exploitability

The attack vector is network-based with low complexity: an attacker simply crafts a malicious HTML page and serves it to a target. User interaction is required (the victim must view the page), but this is a low bar—the page could be hosted on a compromised site, in a phishing email, or injected via a man-in-the-middle attack. Once loaded, the vulnerability is triggered automatically. The attack does not require any special browser configuration or plugins, making it broadly exploitable against default Chrome installations.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Organizations should prioritize this patch for all systems, particularly those used by employees who browse the internet or access external web applications. For enterprises with managed Chrome deployments, push the update through your device management platform immediately. Verify that auto-update is enabled; if it is disabled, manual patching is required. Smaller organizations and individuals should enable automatic updates in Chrome settings (Settings > About Chrome).

Patch guidance

Verify and deploy Chrome version 150.0.7871.115 or later across your environment. Check your device management console (if applicable) to confirm deployment status. For organizations managing Chrome Enterprise, use your admin console to push the update and verify completion. End users can manually check Settings > About Google Chrome, which will trigger an update check if one is available. Restart Chrome to apply the patch; the browser may be configured to restart automatically at the next launch. After patching, confirm the version number matches 150.0.7871.115 or higher.

Detection guidance

Monitor Chrome version deployments in your environment to ensure systems are running 150.0.7871.115 or later. Check browser version strings via device inventory tools or endpoint detection systems. Network-level detection is limited since the exploit uses standard HTTP/HTTPS traffic; however, behavioral anomalies (unexpected process spawning from Chrome, unusual memory access patterns) may indicate exploitation attempts. Implement application whitelisting or behavior monitoring to catch post-exploitation activity. If you suspect a system has been compromised, isolate it, capture memory and disk forensics, and check for signs of credential theft or lateral movement.

Why prioritize this

This vulnerability merits immediate action despite not being on the KEV list. The combination of a network attack vector, low complexity, minimal user interaction, and critical internal severity rating—coupled with the widespread deployment of Chrome in enterprise environments—creates substantial risk. The use-after-free nature of the flaw enables direct memory corruption, which is a hallmark of high-impact exploits. Prioritize patching for systems used by high-value targets (executives, developers, finance staff) first, then roll out to the broader user base.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the network attack vector, low complexity, and lack of privilege or special configuration requirements. The impact is severe: the vulnerability allows confidentiality, integrity, and availability violations (all marked High in the vector), meaning an attacker can read sensitive data, modify system state, or crash the browser and potentially the system. The score aligns with the Chromium team's Critical severity assessment; the slight difference (8.8 vs. potential 9.0+) may reflect assumptions about attack reliability or user interaction. For practical purposes, treat this as a critical patch.

Frequently asked questions