# CVE-2026-15121: Google Chrome use after free in WebRTC

Source: https://junglewise.ai/threats/cve-2026-15121-google-chrome-use-after-free-in-webrtc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-15121 · Severity: info · CVSS 8.8 · Published 2026-07-08

A security vulnerability exists in Google Chrome's WebRTC component, which is used for real-time communication like video calls and voice chat. By tricking a user into visiting a specially crafted website, an attacker could potentially execute unauthorized code on the user's computer. While the attack is limited by the browser's security sandbox, it could still lead to significant security compromises or service instability.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-15121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15121 being exploited in the wild.

**How severe is CVE-2026-15121?** Informational severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** Google Chrome < 150.0.7871.115.

**Is there a fix for CVE-2026-15121?** A patch was published on 2026-07-08: Fixed in version 150.0.7871.115 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15121 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15121?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the WebRTC component of Google Chrome prior to version 150.0.7871.115. The flaw is triggered when the browser incorrectly manages memory during the processing of WebRTC content, which can be exploited by a remote attacker using a crafted HTML page. Successful exploitation allows for arbitrary code execution within the context of the browser's sandbox. The vulnerability was reported by Google internal researchers and is addressed in the stable channel update for Windows, Mac, and Linux.

## Affected products

- Google Chrome < 150.0.7871.115

## Timeline

- 2026-06-14: disclosed: Reported to the Chromium project
- 2026-07-08: patched: Fixed in version 150.0.7871.115
- 2026-07-08: advisory: NVD and Chrome Release blog published

## References

- [https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html](https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html)
- [https://issues.chromium.org/issues/523712556](https://issues.chromium.org/issues/523712556)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)