Use after free in Views in Google Chrome prior to 150

CVE-2026-15129 is a use-after-free (CWE-416) in Chromium's Views UI framework — the toolkit that draws tabs, dialogs, omnibox popups, and permission prompts. A crafted page (or embedded content that triggers a Views-managed dialog/prompt lifecycle) can free a Views object while another reference is still live, then reclaim the slot with attacker-controlled data. All Chrome, Chromium, Edge, Brave, Opera, and Electron builds prior to the 150.0.7871.115 milestone inherit the flaw.

There is no vendor CVSS on this ID yet — Google historically labels this class 'High' in the Chrome VRP because Views runs in the privileged browser process, not the sandboxed renderer. That means a successful exploit skips the usual sandbox-escape stage entirely. On real-world fleet math (near-universal Chromium presence, drive-by delivery, no auth required) treating this as anything less than HIGH is optimistic; we agree with the implicit Google grading.

Why this verdict

• Browser-process impact: Views is not sandboxed — this is not a renderer bug that still needs a second CVE to matter. One bug, user-token code exec.
• Fleet ubiquity: Chromium is on nearly every managed endpoint. Delivery is drive-by; no auth, no lateral movement needed to reach the vulnerable surface.
• Class precedent: Every prior Views UAF in the last 24 months has been rated High by Google and several were weaponized within weeks of disclosure.
• Role multiplier: The affected component (browser) runs on workstations of admins, developers, and SSO-authenticated humans. A browser-process compromise on a domain-admin jumpbox or CI operator laptop ends in cookie theft → SSO replay → identity-provider access. Blast radius on privileged endpoints is fleet-scale via credential theft, not host-scale.
• Friction that keeps this at HIGH not CRITICAL: Requires user to visit attacker content (UI:R), MiraclePtr may neutralize the primitive, and enterprise SWG/isolation intercepts a meaningful fraction of drive-by traffic. No public PoC yet.

Why not higher?

Not CRITICAL because there is no confirmed in-the-wild exploitation, no public PoC, and Chrome's MiraclePtr / BackupRefPtr mitigation has historically converted a majority of Views UAFs into safe crashes. User interaction is required (page visit), which further compresses the reachable population versus a wormable network service.

Why not lower?

Not MEDIUM because the bug lives in the unsandboxed browser process, the affected install base is effectively every managed endpoint, and this bug class (Views UAF) has a strong precedent of successful weaponization. Cookie/token theft from a browser-process compromise routinely pivots into identity-provider access, which is not a MEDIUM-level outcome.

1. Force Chrome auto-update and verify version ≥ 150.0.7871.115 fleet-wide — Push the RelaunchNotification and RelaunchNotificationPeriod policies to force a browser restart within 24–48 hours. Deploy within the noisgate HIGH mitigation SLA of 30 days — but given browser-process impact, treat as 7 days operationally.
2. Patch Chromium-based siblings on the same clock — Edge, Brave, Opera, Vivaldi ship the same Views tree. Track their respins and roll them within the same 30-day window. Do not forget Electron apps (Slack, Teams desktop, Discord, VS Code) — inventory via SBOM.
3. Enable Site Isolation + Enhanced Safe Browsing enterprise-wide — Set IsolateOrigins=* and SitePerProcess=true via GPO/MDM; enable SafeBrowsingProtectionLevel=2 (Enhanced). Reduces cross-origin leak surface and blocks a large fraction of drive-by delivery.
4. Deploy remote browser isolation for high-risk users — Admin, finance, and executive users should browse untrusted zones through Menlo / Cloudflare Browser Isolation / Zscaler ZIA Isolation. Neutralizes the entire client-side attack surface for those users.
5. Kill saved-password auto-fill on privileged workstations — Disable PasswordManagerEnabled on domain-admin and Tier-0 endpoints — removes the Login Data prize even if browser-process exec succeeds.

Run on each Windows endpoint (or via your RMM / Intune script agent) as any user with read access to the Chrome install path. Invoke: .\Check-CVE-2026-15129.ps1. Emits VULNERABLE / PATCHED / UNKNOWN and exits with codes 1/0/2 respectively. macOS/Linux equivalents should check mdls / dpkg -s google-chrome-stable.

#requires -Version 5.1
# Check-CVE-2026-15129.ps1
# Detects Chrome / Edge / Brave builds vulnerable to CVE-2026-15129 (Views UAF)
# Fixed Chrome build: 150.0.7871.115

$ErrorActionPreference = 'SilentlyContinue'
$fixed = [Version]'150.0.7871.115'
$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles\Microsoft\Edge\Application\msedge.exe",
    "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe",
    "$env:ProgramFiles\BraveSoftware\Brave-Browser\Application\brave.exe"
)

$found = $false
$vulnerable = $false

foreach ($p in $paths) {
    if (Test-Path $p) {
        $found = $true
        try {
            $v = [Version](Get-Item $p).VersionInfo.ProductVersion
            if ($v -lt $fixed) {
                Write-Output "VULNERABLE: $p at $v (< $fixed)"
                $vulnerable = $true
            } else {
                Write-Output "PATCHED:    $p at $v"
            }
        } catch {
            Write-Output "UNKNOWN:    $p (could not parse version)"
        }
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN: no Chromium-family browser found in standard install paths'
    exit 2
}
if ($vulnerable) { exit 1 } else { exit 0 }

Sources

1. Chrome Releases — Stable Channel Update for Desktop
2. Chromium Security — Views + MiraclePtr
3. CWE-416: Use After Free
4. CISA KEV Catalog
5. FIRST EPSS
6. Google Project Zero — Chrome exploit writeups
7. Chrome Enterprise Policy List (RelaunchNotification, IsolateOrigins, SafeBrowsingProtectionLevel)
8. Man Yue Mo — Chromium Views UAF research (GitHub Security Lab)