CVE-2026-6309
Published: 15 April 2026
Summary
CVE-2026-6309 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific use-after-free flaw in Chrome's Viz component by applying the update to version 147.0.7727.101 or later.
Implements memory protection mechanisms like ASLR, DEP, and stack canaries that directly mitigate exploitation of use-after-free vulnerabilities in the renderer process.
Enforces process isolation to contain a compromised renderer process and prevent sandbox escape to higher-privilege system components.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Viz allows renderer sandbox escape via crafted HTML, directly enabling privilege escalation from sandboxed process and client application code execution.
NVD Description
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-6309 is a use-after-free vulnerability (CWE-416) in the Viz component of Google Chrome prior to version 147.0.7727.101. This flaw, with a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and rated High severity by Chromium, allows potential exploitation when handling crafted content.
A remote attacker who has compromised the renderer process can exploit this vulnerability through a crafted HTML page to potentially escape the sandbox. The attack requires network access, high complexity, no privileges, user interaction, and results in changed scope with high impacts to confidentiality, integrity, and availability.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.101 or later, as detailed in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html. Additional technical details are tracked in the Chromium issue at https://issues.chromium.org/issues/497846428.
Details
- CWE(s)