CVE-2026-15132: Critical V8 Engine RCE in Google Chrome—Patch Guidance

Technical summary

CVE-2026-15132 is an uninitialized variable use flaw (CWE-457) in the V8 JavaScript engine bundled with Google Chrome. The vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution within the Chrome sandbox by delivering a malicious HTML page to a user. The attack requires user interaction—specifically visiting a crafted webpage—but no additional privileges. Chromium's security team assigned this a High severity rating. The CVSS 3.1 score of 8.8 reflects the high impact potential (complete compromise of confidentiality, integrity, and availability) combined with low attack complexity and network-based attack vector.

Business impact

Organizations with users running vulnerable Chrome versions face heightened risk of targeted attacks. Successful exploitation could allow attackers to steal sensitive data, install malware, or compromise user sessions without triggering traditional endpoint detection. While the sandbox provides a containment boundary, this vulnerability bypasses the sandbox's integrity guarantees, potentially allowing lateral movement or privilege escalation depending on the host OS and Chrome configuration. Users handling sensitive information via web applications are at particular risk. The widespread use of Chrome in enterprise environments amplifies the potential impact across many organizations.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes all stable, beta, and extended-support releases below this version threshold. Chrome on all major operating systems (Windows, macOS, Linux, iOS, and Android) using the V8 engine is affected. Organizations should audit Chrome deployment versions across their environment, including managed devices and any BYOD deployments where Chrome is present.

Exploitability

The vulnerability is relatively easy to exploit from the attacker's perspective. An attacker only needs to host a malicious HTML page and convince a user to visit it—accomplished through phishing, malicious advertising, or drive-by downloads. No advanced techniques, user configuration changes, or system-level privileges are required. The attack surface is broad given Chrome's ubiquity, though exploitation is constrained to users actively browsing to attacker-controlled or compromised websites during a vulnerable version's presence. The requirement for user interaction (visiting the page) lowers the barrier compared to zero-click exploits but remains highly practical for targeted campaigns.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Chrome's auto-update mechanism will push this version to most users, but verification is recommended for controlled enterprise environments. Ensure that automatic security updates are enabled in Chrome settings. For organizations managing Chrome through device policy (MDM/EMM), push the update via policy controls to enforce adoption. Users on extended-support channels should verify their assigned version is at or above the fixed release. No workarounds exist; patching is the only mitigation.

Patch guidance

Google Chrome released security update 150.0.7871.115 to address this vulnerability. Deploy this version across all instances of Chrome in your environment. Verify patch installation by navigating to chrome://settings/help, which displays the installed version and confirms auto-update completion. For enterprise deployments, use Chrome policy templates or your MDM platform to set the minimum required version. Test the update in a limited group before full rollout to confirm compatibility with critical web applications. Monitor the Chromium security releases page for any subsequent patched versions addressing related issues.

Detection guidance

Monitor for browser crash logs or V8 engine errors correlated with visits to suspicious domains or phishing attempts—these may indicate exploitation attempts. Endpoint detection and response (EDR) tools should flag unusual Chrome child process behavior, including spawning system commands or accessing sensitive files, which could indicate post-exploitation activity. Network detection should identify traffic to known malicious HTML-hosting infrastructure. User reports of unexpected browser behavior or pop-ups coinciding with V8 crashes warrant investigation. Cross-reference web proxy logs with known phishing campaigns to identify users who may have been exposed. Chrome's own crash reporting (if enabled) can provide telemetry on V8 failures in your organization.

Why prioritize this

This vulnerability warrants immediate prioritization due to its high CVSS score (8.8), ease of exploitation, low barrier to attack, and broad user base affected. The lack of KEV (Known Exploited Vulnerability) status does not diminish urgency—the practical exploitability and widespread Chrome deployment mean active exploitation is likely imminent. RCE vulnerabilities in ubiquitous browsers represent top-tier risk. Organizations should treat this as a critical patch with 24–48 hour deployment targets for high-risk user populations (executives, finance, legal) and 7-day targets for general populations.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-based attack vector (AV:N) requiring no local access; (2) Low attack complexity (AC:L), as exploitation requires only a crafted HTML page; (3) No privileges required (PR:N); (4) User interaction required (UI:R), limiting but not preventing widespread exploitation; (5) Unchanged scope (S:U), with impact contained to the Chrome process; and (6) High impact on confidentiality, integrity, and availability (C:H/I:H/A:H), as arbitrary code execution within the sandbox allows data theft, code injection, or process termination. The score appropriately signals a serious, readily exploitable flaw demanding swift remediation.

Frequently asked questions