Loading vulnerability…
Use-after-free in Google Chrome Views
CVE-2026-15129 is a use-after-free vulnerability in the Views user interface framework of Google Chrome before version 150.0.7871.115. A remote attacker can potentially exploit heap corruption by causing the browser to process a crafted HTML page. Successful exploitation may enable arbitrary code execution within the affected browser. The specific vulnerable function and object lifetime sequence are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause heap corruption in Chrome and may enable remote code execution or browser compromise. Full system compromise through a sandbox escape would require additional exploitation; a standalone sandbox escape is not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Palo Alto Networks explicitly states that no known workarounds exist for the affected Prisma Browser issue. Apply the appropriate browser security update.
Patch, then assume compromise.
Upgrade Google Chrome to 150.0.7871.115 or later, or install the latest vendor-supported security release for the platform. Platform-specific release notices also identify 150.0.7871.114 as a fixed release for Linux and some Windows builds, despite the general CVE description using 150.0.7871.115 as the version boundary. For Debian Chromium, install 150.0.7871.114-1~deb13u1 or later on Debian 13 (trixie), or 150.0.7871.114-1~deb12u1 or later on Debian 12. For Prisma Browser, upgrade to 150.41.2.115 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.