# Google Chrome 150.0.7871.114/.115 Patches 27 Vulnerabilities Including Two Critical Use-After-Free Flaws (CVE-2026-15112, CVE-2026-15129)

> Google shipped two Chrome Stable updates on consecutive days (July 7-8, 2026), culminating in 150.0.7871.114/.115, which fixes 27 security vulnerabilities including two critical use-after-free bugs in the Ozone (CVE-2026-15112) and Views (CVE-2026-15129) components that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Google has not reported active in-the-wild exploitation of any of the 27 issues.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-19T04:08:54.565Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1173
- **ID:** TL-2026-1173
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15107, CVE-2026-15108, CVE-2026-15109, CVE-2026-15110, CVE-2026-15111, CVE-2026-15112, CVE-2026-15113, CVE-2026-15114, CVE-2026-15115, CVE-2026-15116, CVE-2026-15117, CVE-2026-15118, CVE-2026-15119, CVE-2026-15120, CVE-2026-15121, CVE-2026-15122, CVE-2026-15123, CVE-2026-15124, CVE-2026-15125, CVE-2026-15126, CVE-2026-15127, CVE-2026-15128, CVE-2026-15129, CVE-2026-15130, CVE-2026-15131, CVE-2026-15132, CVE-2026-15133

## Description

On July 7-8, 2026, Google released back-to-back Chrome Stable channel updates for Windows, macOS, and Linux (150.0.7871.114/.115), following an earlier 150.0.7871.100/.101 push on July 7. The combined update batch addresses 27 security vulnerabilities discovered via internal audits, fuzzing (AddressSanitizer, MemorySanitizer, Control Flow Integrity, libFuzzer, AFL, Valgrind), and external bug-bounty submissions through the Chrome Vulnerability Reward Program (VRP).

The two vulnerabilities rated Critical are both use-after-free (CWE-416) memory-safety bugs: CVE-2026-15112 in the Ozone platform-abstraction layer (Chrome's windowing/graphics backend used on Linux and ChromeOS-adjacent builds), described by vendor/aggregator analysis as enabling memory corruption leading to arbitrary code execution, and CVE-2026-15129 in the Views UI toolkit (Chrome's native desktop widget framework), described as heap corruption with sandbox-escape potential. Both carry a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and are described by NVD/Chromium as allowing 'a remote attacker to potentially exploit heap corruption via a crafted HTML page' — meaning a victim need only load an attacker-controlled or attacker-compromised web page (drive-by/client-side vector) for exploitation to begin, no additional privileges required, but requiring some form of user interaction (e.g., navigating to the page). Secondary reporting notes that use-after-free bugs of this class are 'particularly dangerous because they can be leveraged to corrupt the heap, potentially leading to sandbox escapes or full system compromise when combined with other bugs' — i.e., chained with a renderer sandbox-escape or a second info-leak/UAF bug.

The remaining 25 vulnerabilities span a wide range of Chrome subsystems, each mapped to a distinct component and bug class: use-after-free bugs in Extensions (CVE-2026-15110), Views (CVE-2026-15111), Autofill (CVE-2026-15113), Actor (CVE-2026-15116), Payments (CVE-2026-15117), Input (CVE-2026-15118), Core (CVE-2026-15120), WebRTC (CVE-2026-15121), Forms (CVE-2026-15126), IndexedDB (CVE-2026-15107, Medium), and InterestGroups/Privacy Sandbox (CVE-2026-15133); uninitialized-memory use in V8 the JavaScript engine (CVE-2026-15132) and ANGLE the graphics-translation layer (CVE-2026-15109); integer overflow in the Extensions API (CVE-2026-15108); out-of-bounds read/write in Codecs (CVE-2026-15114); insufficient input/data validation in Codecs (CVE-2026-15122), WebAppInstalls (CVE-2026-15115), DOM (CVE-2026-15123), and Navigation (CVE-2026-15131, Medium); insufficient policy enforcement in Passwords (CVE-2026-15124) and Navigation (CVE-2026-15130); and inappropriate-implementation flaws in GetUserMedia/WebRTC media capture (CVE-2026-15119), Forms (CVE-2026-15125, CVE-2026-15128), and WebGL (CVE-2026-15127).

The breadth of affected subsystems — extensions, payments/autofill (sensitive user data), WebRTC/GetUserMedia (camera/microphone access APIs), WebGL (GPU-process attack surface), and password management — means the batch is not limited to a single attack surface: a threat actor with a working exploit for the two Critical UAFs (Ozone/Views) could pursue initial code execution via a crafted page, while several of the High-severity bugs (Extensions, Payments, Autofill, Passwords, WebRTC/GetUserMedia) represent secondary risk to sensitive browser-managed data and device peripherals (camera/mic) if independently or chain-exploited.

Notable VRP-credited researchers include Pierre Langlois of Arm (CVE-2026-15132, uninitialized use in V8, $500 reward), Jihyeon Jeong of Compsec Lab, Seoul National University (CVE-2026-15133, use-after-free in InterestGroups, $500 reward), and zh1x1an1221 of Ant Group (CVE-2026-15107, use-after-free in IndexedDB, $2,000 reward). Corresponding fixes shipped to Chrome for Android (150.0.7871.114) and iOS (150.0.7871.113). This release followed an earlier, larger Chrome 150 stable rollout around July 2, 2026 that patched 382 issues (15 rated critical), indicating an unusually dense two-week patch cadence for the Chrome browser. Google states none of the 27 vulnerabilities in this batch are known to be exploited in the wild; no public PoC exploit code has surfaced for CVE-2026-15112 or CVE-2026-15129 as of this writing. Given the drive-by nature of use-after-free bugs of this class and Chrome's history of these bug classes being weaponized post-disclosure (via 1-day exploitation as defenders lag on patch rollout), organizations should treat rapid patch deployment as time-sensitive.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1176 Software Extensions
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1518 Software Discovery
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1125 Video Capture
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service
- T1190 Exploit Public-Facing Application
- T1587 Develop Capabilities
- T1185 Browser Session Hijacking
- T1497 Virtualization/Sandbox Evasion

## Sources

- [Two Chrome updates in two days fix critical vulnerabilities](https://www.malwarebytes.com/blog/news/2026/07/two-chrome-updates-in-two-days-fix-critical-vulnerabilities)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop.html)
- [Google Chrome Update Patches 27 Security Vulnerabilities Including Critical Use-After-Free Flaws](https://gbhackers.com/google-chrome-update-patches-27-security-vulnerabilities/)
- [Google fixes 2 critical Chrome bugs with two quick patches in a row](https://www.pcworld.com/article/3187928/google-fixes-2-critical-chrome-bugs-with-two-quick-patches-in-a-row.html)
- [NVD - CVE-2026-15112](https://nvd.nist.gov/vuln/detail/CVE-2026-15112)
- [NVD - CVE-2026-15129](https://nvd.nist.gov/vuln/detail/CVE-2026-15129)
- [CVE-2026-15107: Use after free in Google Chrome - Threat Radar](https://radar.offseq.com/threat/cve-2026-15107-use-after-free-in-google-chrome-e2a2c96e28e21357)
- [Chrome needs another whopper update to fix 382 security bugs](https://www.malwarebytes.com/blog/bugs/2026/07/chrome-needs-another-whopper-update-to-fix-382-security-fixes)
- [Chromium Issue Tracker - Issue 518006275 (CVE-2026-15112)](https://issues.chromium.org/issues/518006275)
- [Chromium Issue Tracker - Issue 524045160 (CVE-2026-15129)](https://issues.chromium.org/issues/524045160)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1173