Cyber Posture

CVE-2026-6359

High

Published: 15 April 2026

Published
15 April 2026
Modified
17 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6359 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Drive-by Compromise (T1189) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the use-after-free vulnerability by requiring timely remediation through patching Chrome to version 147.0.7727.101 or later.

prevent

Implements memory protection mechanisms such as ASLR and DEP that directly prevent exploitation of use-after-free flaws leading to out-of-bounds access.

prevent

Enforces process isolation via sandboxing to contain damage from a compromised renderer process and prevent escalation to the broader system.

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in Chrome renderer via crafted HTML page on malicious site directly enables drive-by compromise and client-side exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-6359 is a use-after-free vulnerability (CWE-416) in the Video component of Google Chrome on Windows versions prior to 147.0.7727.101. Published on 2026-04-15, it allows a remote attacker who has compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. The flaw carries a Chromium security severity of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The attack scenario involves a remote attacker who has already compromised the Chrome renderer process, which is sandboxed but vulnerable under those conditions. Exploitation requires user interaction, such as visiting a malicious site, and enables out-of-bounds memory access that could lead to high confidentiality, integrity, and availability impacts.

Mitigation details are provided in Google's stable channel update for Chrome desktop at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html, which includes the patch in version 147.0.7727.101. Additional technical information is available in the Chromium issue tracker at https://issues.chromium.org/issues/490251701.

Details

CWE(s)

Affected Products

google
chrome
≤ 147.0.7727.101

CVEs Like This One

CVE-2026-6358Same product: Google Chrome
CVE-2025-0995Same product: Google Chrome
CVE-2025-2136Same product: Google Chrome
CVE-2025-1006Same product: Google Chrome
CVE-2025-2476Same product: Google Chrome
CVE-2026-6360Same product: Google Chrome
CVE-2025-0762Same product: Google Chrome
CVE-2025-0997Same product: Google Chrome
CVE-2026-6315Same product: Google Chrome
CVE-2025-1916Same product: Google Chrome

References