PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6300 Google CVE debrief

A use-after-free vulnerability in the CSS processing component of Google Chrome versions prior to 147.0.7727.101 enables remote code execution within the browser sandbox. The flaw, assigned CVSS 3.1 score 8.8 (High), can be triggered when a victim renders a maliciously crafted HTML page. The vulnerability was disclosed by Google on April 15, 2026, with the NVD record subsequently modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Organizations with Chrome deployments, particularly those with users accessing external web content; security teams monitoring browser-based attack vectors; incident responders investigating suspicious browser activity or crashes

Technical summary

The vulnerability exists in Chrome's CSS engine where improper memory management leads to a use-after-free condition. When processing specially crafted CSS within a malicious HTML document, freed memory may be accessed and manipulated, potentially allowing an attacker to corrupt heap state and achieve arbitrary code execution within the Chrome sandbox. The attack vector requires user interaction (rendering the malicious page) but does not require elevated privileges. The sandbox containment limits the immediate system impact, though sandbox escape chains may elevate to full compromise.

Defensive priority

high

Recommended defensive actions

  • Upgrade Google Chrome to version 147.0.7727.101 or later to remediate the use-after-free vulnerability in CSS processing
  • Apply security updates through Chrome's automatic update mechanism or manual download from official Google channels
  • For enterprise deployments, validate Chrome version compliance across endpoints and prioritize patching for systems with users accessing untrusted web content
  • Monitor for anomalous browser crashes or unexpected sandbox escape attempts that may indicate exploitation attempts
  • Review web filtering policies to restrict access to untrusted or newly registered domains as a compensating control until patching is complete

Evidence notes

The CVE description and NVD metadata confirm this is a use-after-free (CWE-416) in Chrome's CSS engine. The vendor field shows 'Apple' with medium confidence from NVD CPE data, though this appears to be a platform association rather than the affected product vendor. The primary affected product is Google Chrome per the CVE description and CPE criteria. Chrome release notes and Chromium issue tracker entries are cited as authoritative sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6300 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6300

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6300 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6300

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.