CVE-2026-15133: Chrome Use-After-Free in InterestGroups (CVSS 8.8)

Technical summary

CVE-2026-15133 is a use-after-free bug (CWE-416) in Chrome's InterestGroups implementation. Use-after-free vulnerabilities occur when a program accesses memory that has already been freed, allowing attackers to overwrite freed memory regions or trigger unexpected behavior. In this case, improper lifecycle management of InterestGroups objects permits remote code execution with High severity. The vulnerability is reachable via malicious HTML delivered over the network, requiring only user action (page navigation) to trigger. Execution occurs within the browser sandbox, which provides a containment layer but does not eliminate the risk of further exploitation.

Business impact

A successful exploitation chain could allow attackers to steal sensitive user data (credentials, browsing history, saved passwords) or use the sandbox as a pivot point for additional attacks. For organizations, widespread Chrome exploitation increases endpoint compromise risk, particularly if users cannot be prevented from visiting untrusted sites. Incident response and credential rotation costs may follow successful attacks. The high CVSS score (8.8) reflects the combination of network accessibility, low attack complexity, and confidentiality/integrity/availability impact.

Affected systems

Google Chrome prior to version 150.0.7871.115 is affected across all platforms (Windows, macOS, Linux). The vulnerability impacts standard Chrome installations and Chromium-based browsers that include the InterestGroups feature. Enterprise Chrome deployments managed via policy may have different update timelines. Verify the exact version deployed in your environment—Chrome auto-updates, but organizations with managed deployments should confirm rollout status.

Exploitability

Exploitability is high. The attack requires only a crafted HTML page and user interaction (visiting a link or page), both low barriers. No special privileges or complex setup are needed on the attacker side. The flaw is reachable remotely via any network path to a user's browser. However, successful exploitation depends on the victim's browser version and whether the InterestGroups feature is enabled in their configuration. Public exploitation activity has not been confirmed in the CISA KEV catalog, but the vulnerability's inherent simplicity suggests rapid weaponization is likely once disclosure details circulate.

Remediation

Update Chrome to version 150.0.7871.115 or later immediately. Chrome auto-updates, but users should verify their version in Settings > About Google Chrome. For enterprise deployments, push the update via your configuration management system and verify adoption across endpoints. No workarounds mitigate the vulnerability short of disabling the browser or blocking untrusted sites—patching is the only reliable solution.

Patch guidance

Users should enable automatic updates and confirm they are running Chrome 150.0.7871.115 or newer. Enterprise administrators should deploy the patch through their device management policies (Intune, JAMF, etc.) and track compliance metrics. Verify patch success by checking browser version numbers in your MDM console. If manual Chrome deployment is used, manually trigger updates or queue the installer. Prioritize this patch above regular update schedules due to the high severity and lack of workarounds.

Detection guidance

Endpoint detection should focus on identifying unpatched Chrome versions through inventory scans or MDM reporting. Monitor for unusual child processes spawned by chrome.exe (possible sandbox escape attempts) or abnormal memory access patterns. Network-level detection is limited since the attack involves legitimate HTML; however, you may log attempts to visit known malicious domains hosting exploit kits. Hunt for indicators of lateral movement or credential theft following unpatched Chrome usage on sensitive systems.

Why prioritize this

This vulnerability scores 8.8 CVSS (High severity) with no KEV designation but clear exploitability. Prioritize it for patching within 1–2 weeks, especially for users handling sensitive data or accessing internal resources. The low attack complexity and network accessibility, combined with sandbox containment bypass potential, make it a critical endpoint risk. Organizations with user populations visiting untrusted sites should treat it as urgent.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a score of 8.8 (High). Network accessibility (AV:N) and low attack complexity (AC:L) maximize the likelihood of exploitation. Lack of privileges required (PR:N) means any user can be targeted. User interaction (UI:R) is the only limiting factor—the attacker must trick the user into visiting a malicious page. Scope unchanged (S:U) means impact is limited to the Chrome process. High ratings for confidentiality, integrity, and availability reflect the sandbox execution context and potential for information leakage or code execution.

Frequently asked questions