Loading vulnerability…
Use-After-Free in Google Chrome Ozone
CVE-2026-15112 is a use-after-free vulnerability in the Ozone platform-abstraction component of Google Chrome and Chromium versions prior to 150.0.7871.115. A remote attacker can use a crafted HTML page to trigger heap corruption when it is loaded by a victim.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause heap corruption and may enable arbitrary code execution or browser compromise in the victim's browser context.
If you can’t patch tonight, do this now.
Apply browser updates on an accelerated schedule and prioritize high-risk users. Until patching is complete, reduce exposure by limiting access to untrusted web content, enforcing browser hardening and application control policies, isolating browser activity where possible, and monitoring for signs of browser exploitation or crash activity consistent with memory-corruption attempts. No specific workaround is currently available.
Patch, then assume compromise.
Update Google Chrome or Chromium to a vendor-provided fixed release. Google Chrome should be upgraded to version 150.0.7871.115 or later; platform-specific vendor updates may provide 150.0.7871.114 as the fixed build for Linux and Windows. Prisma Browser installations should be upgraded to 150.41.2.115 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.