Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities Including Two Critical Use-After-Free Flaws (CVE-2026-15112, CVE-2026-15129)
Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities (TL-2026-1173), also tracked as Chrome 150.0.7871.114/.115 Security Update, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-10 and last reviewed 2026-07-19. It has no confirmed attribution, affects Google Chrome (Windows), references 27 CVEs (CVE-2026-15107, CVE-2026-15108, CVE-2026-15109), maps to 20 MITRE ATT&CK techniques (T1005, T1068, T1071), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1173
- Threat ID
- TL-2026-1173
- Also known as
- Chrome 150.0.7871.114/.115 Security Update, Chrome Two-Day Back-to-Back Stable Update
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-10
- Last reviewed
- 2026-07-19
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all-sectors-generic-browser-user-base, enterprise-endpoint, government administration, finance, health, education, consumer
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 27
- Updates
- 2026-07-19 · revalidated 1× · latest source
Google shipped two Chrome Stable updates on consecutive days (July 7-8, 2026), culminating in 150.0.7871.114/.115, which fixes 27 security vulnerabilities including two critical use-after-free bugs in the Ozone (CVE-2026-15112) and Views (CVE-2026-15129) components that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Google has not reported active in-the-wild exploitation of any of the 27 issues.
How Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities works
On July 7-8, 2026, Google released back-to-back Chrome Stable channel updates for Windows, macOS, and Linux (150.0.7871.114/.115), following an earlier 150.0.7871.100/.101 push on July 7. The combined update batch addresses 27 security vulnerabilities discovered via internal audits, fuzzing (AddressSanitizer, MemorySanitizer, Control Flow Integrity, libFuzzer, AFL, Valgrind), and external bug-bounty submissions through the Chrome Vulnerability Reward Program (VRP).
The two vulnerabilities rated Critical are both use-after-free (CWE-416) memory-safety bugs: CVE-2026-15112 in the Ozone platform-abstraction layer (Chrome's windowing/graphics backend used on Linux and ChromeOS-adjacent builds), described by vendor/aggregator analysis as enabling memory corruption leading to arbitrary code execution, and CVE-2026-15129 in the Views UI toolkit (Chrome's native desktop widget framework), described as heap corruption with sandbox-escape potential. Both carry a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and are described by NVD/Chromium as allowing 'a remote attacker to potentially exploit heap corruption via a crafted HTML page' — meaning a victim need only load an attacker-controlled or attacker-compromised web page (drive-by/client-side vector) for exploitation to begin, no additional privileges required, but requiring some form of user interaction (e.g., navigating to the page). Secondary reporting notes that use-after-free bugs of this class are 'particularly dangerous because they can be leveraged to corrupt the heap, potentially leading to sandbox escapes or full system compromise when combined with other bugs' — i.e., chained with a renderer sandbox-escape or a second info-leak/UAF bug.
The remaining 25 vulnerabilities span a wide range of Chrome subsystems, each mapped to a distinct component and bug class: use-after-free bugs in Extensions (CVE-2026-15110), Views (CVE-2026-15111), Autofill (CVE-2026-15113), Actor (CVE-2026-15116), Payments (CVE-2026-15117), Input (CVE-2026-15118), Core (CVE-2026-15120), WebRTC (CVE-2026-15121), Forms (CVE-2026-15126), IndexedDB (CVE-2026-15107, Medium), and InterestGroups/Privacy Sandbox (CVE-2026-15133); uninitialized-memory use in V8 the JavaScript engine (CVE-2026-15132) and ANGLE the graphics-translation layer (CVE-2026-15109); integer overflow in the Extensions API (CVE-2026-15108); out-of-bounds read/write in Codecs (CVE-2026-15114); insufficient input/data validation in Codecs (CVE-2026-15122), WebAppInstalls (CVE-2026-15115), DOM (CVE-2026-15123), and Navigation (CVE-2026-15131, Medium); insufficient policy enforcement in Passwords (CVE-2026-15124) and Navigation (CVE-2026-15130); and inappropriate-implementation flaws in GetUserMedia/WebRTC media capture (CVE-2026-15119), Forms (CVE-2026-15125, CVE-2026-15128), and WebGL (CVE-2026-15127).
The breadth of affected subsystems — extensions, payments/autofill (sensitive user data), WebRTC/GetUserMedia (camera/microphone access APIs), WebGL (GPU-process attack surface), and password management — means the batch is not limited to a single attack surface: a threat actor with a working exploit for the two Critical UAFs (Ozone/Views) could pursue initial code execution via a crafted page, while several of the High-severity bugs (Extensions, Payments, Autofill, Passwords, WebRTC/GetUserMedia) represent secondary risk to sensitive browser-managed data and device peripherals (camera/mic) if independently or chain-exploited.
Notable VRP-credited researchers include Pierre Langlois of Arm (CVE-2026-15132, uninitialized use in V8, $500 reward), Jihyeon Jeong of Compsec Lab, Seoul National University (CVE-2026-15133, use-after-free in InterestGroups, $500 reward), and zh1x1an1221 of Ant Group (CVE-2026-15107, use-after-free in IndexedDB, $2,000 reward). Corresponding fixes shipped to Chrome for Android (150.0.7871.114) and iOS (150.0.7871.113). This release followed an earlier, larger Chrome 150 stable rollout around July 2, 2026 that patched 382 issues (15 rated critical), indicating an unusually dense two-week patch cadence for the Chrome browser. Google states none of the 27 vulnerabilities in this batch are known to be exploited in the wild; no public PoC exploit code has surfaced for CVE-2026-15112 or CVE-2026-15129 as of this writing. Given the drive-by nature of use-after-free bugs of this class and Chrome's history of these bug classes being weaponized post-disclosure (via 1-day exploitation as defenders lag on patch rollout), organizations should treat rapid patch deployment as time-sensitive.
MITRE ATT&CK techniques used in TL-2026-1173
Collection
T1005 Data from Local System; T1119 Automated Collection; T1125 Video Capture; T1185 Browser Session Hijacking
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Persistence
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution; T1204 User Execution
Defense Evasion
T1211 Exploitation for Stealth; T1497 Virtualization/Sandbox Evasion
Impact
T1499 Endpoint Denial of Service
Discovery
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
defense-impairment
Affected products and versions in Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
- Google — Chrome (Windows)
Vulnerable versions: prior to 150.0.7871.114/.115
Fixed in: 150.0.7871.114; 150.0.7871.115 - Google — Chrome (macOS)
Vulnerable versions: prior to 150.0.7871.114/.115
Fixed in: 150.0.7871.114; 150.0.7871.115 - Google — Chrome (Linux)
Vulnerable versions: prior to 150.0.7871.114
Fixed in: 150.0.7871.114 - Google — Chrome for Android
Vulnerable versions: prior to 150.0.7871.114
Fixed in: 150.0.7871.114 - Google — Chrome for iOS
Vulnerable versions: prior to 150.0.7871.113
Fixed in: 150.0.7871.113 - Google — Chromium (open-source upstream, all Chromium-based browsers)
Vulnerable versions: prior to 150.0.7871.114
Fixed in: 150.0.7871.114 or later, pending downstream vendor releases (Edge, Brave, Opera, Vivaldi)
Remediation for Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
Patches
- Chrome 150.0.7871.114/.115 (Windows, macOS)
- Chrome 150.0.7871.114 (Linux)
- Chrome for Android 150.0.7871.114
- Chrome for iOS 150.0.7871.113
Immediate actions
- Update Google Chrome to 150.0.7871.114/.115 (Windows/macOS) or 150.0.7871.114 (Linux) immediately via Help > About Google Chrome or enterprise patch management
- Update Chrome for Android to 150.0.7871.114 and Chrome for iOS to 150.0.7871.113
- Force-restart the browser after update to ensure the patched binary is loaded (Chrome defers applying updates until relaunch)
- For enterprise fleets, push the update via Chrome Browser Cloud Management / Google Admin console or WSUS/SCCM rather than relying on background auto-update alone given the drive-by nature of the flaws
Workarounds
- No viable workaround short of patching; use-after-free bugs of this class are triggerable via any attacker-controlled HTML page, so browsing untrusted sites should be avoided until updated
Longer-term hardening
- Enable Chrome Enhanced Safe Browsing and Site Isolation (enabled by default) to reduce blast radius of renderer-side memory-corruption bugs
- Deploy EDR/browser-isolation tooling capable of detecting anomalous Chrome renderer/GPU process crashes indicative of exploitation attempts
- Track Chromium security release notes (chromereleases.googleblog.com) and subscribe to Chrome VRP disclosures for early warning of newly weaponized bug classes
- Maintain an accelerated patch SLA for browser software given repeated recent use-after-free disclosures across Chrome components
- Audit and restrict camera/microphone permission grants (WebRTC/GetUserMedia) and saved payment/autofill/password data exposure given multiple High-severity bugs in those subsystems this cycle
CVEs associated with Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
- CVE-2026-15107
CVE-2026-15108CVE-2026-15109CVE-2026-15110CVE-2026-15111CVE-2026-15112CVE-2026-15113CVE-2026-15114CVE-2026-15115CVE-2026-15116CVE-2026-15117CVE-2026-15118CVE-2026-15119CVE-2026-15120CVE-2026-15121CVE-2026-15122CVE-2026-15123CVE-2026-15124CVE-2026-15125CVE-2026-15126CVE-2026-15127CVE-2026-15128- CVE-2026-15129
- CVE-2026-15130
- CVE-2026-15131
- CVE-2026-15132
CVE-2026-15133
Weaknesses (CWE) in Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
CWE-416, CWE-190, CWE-457, CWE-20, CWE-1288, CWE-693, CWE-125, CWE-787, CWE-1021, CWE-284
Timeline of Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
- CVE-2026-15112 (use-after-free in Ozone) confirmed discovered internally by Google's security team.
- CVE-2026-15129 (use-after-free in Views) confirmed reported internally to Google.
- Google ships an earlier, larger Chrome 150 stable rollout addressing 382 security issues (15 rated critical), setting an unusually dense two-week patch cadence for the browser.
- Google releases the first of two consecutive-day Chrome Stable updates, version 150.0.7871.100/.101, beginning rollout of fixes later fully detailed in the July 8 release.
- Chrome Vulnerability Reward Program credits are published for external researchers, including Pierre Langlois (Arm, CVE-2026-15132, $500), Jihyeon Jeong (Compsec Lab SNU, CVE-2026-15133, $500), and zh1x1an1221 (Ant Group, CVE-2026-15107, $2,000).
- Malwarebytes Labs, PCWorld, and GBHackers publish coverage of the update batch, summarizing the two critical UAF bugs and the absence of reported in-the-wild exploitation.
- Corresponding security fixes ship for Chrome on Android (150.0.7871.114) and iOS (150.0.7871.113).
- Security aggregator reporting (GBHackers) publishes a full per-CVE component breakdown of the batch, mapping all 27 CVEs to specific Chrome subsystems (Ozone, Views, V8, InterestGroups, Extensions, ANGLE, Autofill, Codecs, WebAppInstalls, Actor, Payments, Input, GetUserMedia, Core, WebRTC, DOM, Passwords, Forms, WebGL, Navigation, IndexedDB) and noting that UAF bugs of this class can be chained toward sandbox escape.
- NVD publishes CVE-2026-15112 and CVE-2026-15129, both scored CVSS 3.1 8.8 (High), describing remote heap-corruption exploitation via a crafted HTML page requiring user interaction.
- Google publishes Chrome Stable 150.0.7871.114/.115 (Windows/macOS) and 150.0.7871.114 (Linux), disclosing 27 fixed vulnerabilities including the two critical use-after-free flaws CVE-2026-15112 (Ozone) and CVE-2026-15129 (Views).
- HKCERT publishes Security Alert A26-07-17, an independent advisory confirming remote exploitability of the pre-150.0.7871.114 Chrome vulnerabilities and urging immediate update.
- As of this research, Google continues to report no known in-the-wild exploitation and no public proof-of-concept exploit code has surfaced for either critical CVE.
- Follow-up research confirms CVE-2026-15112 and CVE-2026-15129 remain absent from the CISA Known Exploited Vulnerabilities (KEV) catalog with no confirmed in-the-wild exploitation.
Update history for TL-2026-1173
- 2026-07-19 — Multiple Vulnerabilities in Google Chrome (HKCERT A26-07-17) — 27 Flaws Fixed in v150.0.7871.114/.115, Including Two Critical Use-After-Free Bugs: What changed No severity/exploitability/status escalation — the newer report itself states neither Critical CVE is in CISA KEV or confirmed exploited in the wild, so the existing PATCHED/POC_PUBLIC/HIGH values stand unchanged. New CVEs (0)
Sources cited for Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
- Two Chrome updates in two days fix critical vulnerabilities
- Chrome Releases: Stable Channel Update for Desktop
- Google Chrome Update Patches 27 Security Vulnerabilities Including Critical Use-After-Free Flaws
- Google fixes 2 critical Chrome bugs with two quick patches in a row
- NVD - CVE-2026-15112
- NVD - CVE-2026-15129
- CVE-2026-15107: Use after free in Google Chrome - Threat Radar
- Chrome needs another whopper update to fix 382 security bugs
- Chromium Issue Tracker - Issue 518006275 (CVE-2026-15112)
- Chromium Issue Tracker - Issue 524045160 (CVE-2026-15129)
Threats related to Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities
- Google Chrome 149 Multiple Memory-Corruption Vulnerabilities Enable Arbitrary Code Execution (CVE-2026-12437 through CVE-2026-12469)
- Google Chrome 150.0.7871.181/.182 Patches 12 High-Severity Vulnerabilities (CVE-2026-16413 through CVE-2026-16424)
- Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws
- Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code
- CVE-2026-8037: Pre-Auth Command Injection RCE in Progress Kemp LoadMaster via Uninitialized-Heap escape_quotes() Flaw on /accessv2
Detection coverage for TL-2026-1173
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1173 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.