CVE-2026-6319
Published: 15 April 2026
Summary
CVE-2026-6319 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6319 is a use-after-free vulnerability (CWE-416) in the Payments component of Google Chrome on Android, affecting versions prior to 147.0.7727.101. Published on 2026-04-15, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated Medium severity by Chromium security.
A remote attacker can exploit this vulnerability by convincing a user to perform specific UI gestures while visiting a crafted HTML page, leading to arbitrary code execution. The attack requires network access with no privileges but demands high complexity and user interaction.
Mitigation is available via the stable channel update for Google Chrome on Android to version 147.0.7727.101 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and the corresponding Chromium issue at https://issues.chromium.org/issues/499018889. Security practitioners should prioritize updating affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23080
Vulnerability details
Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome client application on Android enables arbitrary code execution when a crafted HTML page is visited with specific user gestures, directly mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the specific use-after-free flaw in Chrome via patching to version 147.0.7727.101 or later.
Implements memory protection mechanisms that comprehensively prevent unauthorized memory access and deallocation errors exploited in this use-after-free vulnerability.
Requires vulnerability scanning to identify and prioritize the known Chrome Payments use-after-free vulnerability for remediation.