Use after free in Ozone in Google Chrome prior to 150

Ozone is Chromium's abstraction layer for the underlying windowing/display system — X11, Wayland, Fuchsia, headless, etc. A use-after-free here means Chrome frees a graphics-related object but keeps using the dangling pointer, letting a crafted HTML page corrupt the heap in the renderer process. Affected: all Chrome/Chromium desktop channels prior to 150.0.7871.115; downstream Edge, Brave, Opera, Vivaldi, and Electron apps built on older Chromium ship the same defect until they rebase.

The vendor's HIGH (8.8) rating is *directionally correct but slightly inflated*. CVSS gives no credit for Chrome's site-isolation renderer sandbox, which is the wall between a renderer RCE and OS-level compromise. In practice, exploiting this bug alone gets an attacker code execution inside a sandboxed renderer — meaningful, but a sandbox escape (a separate bug) is required for full host compromise. Reassessed at 7.8: still HIGH, still worth the fast auto-update cycle, not a drop-everything CRITICAL unless chained.

Why this verdict

• Massive install base: Chrome + Chromium downstreams are on essentially every enterprise endpoint. Even with UI:R, the reachable population is >90% of your fleet — friction does not narrow this the way it would for a niche server product.
• UI:R is real friction, not theoretical: a user must load an attacker page. That is stopped by web-proxy category blocking, Safe Browsing, and email-gateway URL rewriting for the majority of opportunistic delivery. This is why 8.8 → 7.8 rather than 8.8 → 8.8.
• Sandbox containment caps blast radius: renderer RCE ≠ host RCE. Without a second (sandbox-escape) bug, the attacker gets code execution in a process that cannot read your home directory, cookies from other origins, or credential stores. CVSS gives no credit for this — noisgate does.
• Role multiplier: Chrome runs primarily on workstations (typical role — chain ends at user-context compromise post-escape) and on some VDI/jump hosts (elevated role — a jump host RCE gets an attacker onto the admin plane, but this is a small fraction of installs). No canonical high-value role is defined by 'runs Chrome' — the floor is HIGH, not CRITICAL.
• No exploit, no KEV, low EPSS today — but patch-diffing Chrome UAFs is a known cottage industry, so weaponization within weeks is a reasonable planning assumption.

Why not higher?

CRITICAL is reserved for chains that end in fleet or identity compromise on their own. This bug requires user interaction AND a separate sandbox-escape bug to reach the host. Neither is present in a public exploit today, and Chrome's auto-update will patch the majority of the fleet within a week without operator action.

Why not lower?

MEDIUM would understate the risk: Chrome is on every endpoint, drive-by delivery is the #1 initial-access vector in commodity intrusion sets, and Chromium UAFs are historically weaponized within weeks of patch. Ignoring this because 'it's just the renderer' gets you owned when a chain drops.

1. Force Chrome auto-update fleet-wide — Push RelaunchNotification = 2 (Required) and RelaunchNotificationPeriod ≤ 86400000 (24h) via GPO/Intune/Jamf so users cannot indefinitely defer the relaunch that finalizes the update. Deploy within the noisgate mitigation SLA of 30 days, ideally within 7.
2. Verify Chromium downstreams — Edge, Brave, Opera, Vivaldi, and every Electron app in your inventory (Slack, Teams-classic, VS Code, Discord, Notion, 1Password desktop) each carry their own Chromium fork. Confirm each ships an equivalent patch and roll it. Same 30-day mitigation window.
3. Enable Site Isolation everywhere — Set IsolateOrigins and SitePerProcess = enabled via policy. This is the control that turns renderer-RCE into a per-origin blast radius rather than an all-tabs compromise. Verify now; it should already be the default on desktop.
4. Tighten web egress via SWG — Ensure Zscaler / Netskope / Umbrella / Defender for Cloud Apps categories 'Newly Registered Domains', 'Uncategorized', and 'Malware' are set to Block. Blocks drive-by delivery pre-navigation.
5. EDR: alert on chrome.exe child processes — chrome.exe should almost never spawn cmd.exe, powershell.exe, wscript.exe, or unexpected LOLBINs. Tune EDR to alert; this catches sandbox-escape post-conditions even if the initial UAF succeeds.

Run on a target Windows endpoint (or via your RMM/Intune script deployment against the fleet). Requires standard user rights — reads Chrome's on-disk version from Program Files. Invoke with .\Check-CVE-2026-15112.ps1 for local, or wrap in your RMM's PowerShell task for fleet-wide execution.

#requires -Version 5.0
# noisgate verifier: CVE-2026-15112 (Chrome Ozone UAF)
# Exit 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$FixedVersion = [Version]'150.0.7871.115'
$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)

$found = $false
$vulnerable = $false
foreach ($p in $paths) {
    if (Test-Path $p) {
        $found = $true
        try {
            $vi = (Get-Item $p).VersionInfo
            $installed = [Version]$vi.ProductVersion
            Write-Host "Found Chrome at $p : $installed"
            if ($installed -lt $FixedVersion) {
                Write-Host "VULNERABLE: $installed < $FixedVersion" -ForegroundColor Red
                $vulnerable = $true
            } else {
                Write-Host "PATCHED: $installed >= $FixedVersion" -ForegroundColor Green
            }
        } catch {
            Write-Host "UNKNOWN: could not parse version at $p" -ForegroundColor Yellow
            exit 2
        }
    }
}

if (-not $found) {
    Write-Host "UNKNOWN: Chrome not installed at standard paths." -ForegroundColor Yellow
    exit 2
}
if ($vulnerable) { exit 1 } else { exit 0 }

Sources

1. Chrome Releases — Stable Channel Update for Desktop
2. NVD — CVE-2026-15112
3. MITRE CWE-416 (Use After Free)
4. Chromium Ozone architecture
5. Chromium MiraclePtr / raw_ptr<T> writeup
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. Microsoft Edge security updates (Chromium downstream)