PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6302 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Video component prior to version 147.0.7727.101 enables remote code execution within the browser sandbox. The flaw, assigned CVSS 3.1 score 8.8 (High), can be triggered when a victim visits a maliciously crafted HTML page. The vulnerability was disclosed by Google on April 15, 2026, with the NVD record subsequently modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Organizations with managed Chrome deployments, security teams responsible for browser security, and end users who browse untrusted web content. The vulnerability is particularly relevant for environments where Chrome is used to access external or user-generated content.

Technical summary

The vulnerability exists in Chrome's Video component where improper memory management leads to a use-after-free condition. When processing crafted HTML content, a freed memory object may be accessed, allowing an attacker to corrupt memory and achieve arbitrary code execution within the browser's sandboxed renderer process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact to confidentiality, integrity, and availability.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.101 or later across all managed endpoints
  • Verify automatic update mechanisms are enabled for Chrome installations
  • Review browser extension policies to reduce attack surface from untrusted web content
  • Monitor for anomalous browser process behavior that may indicate exploitation attempts
  • Apply principle of least privilege for user accounts to limit impact of potential sandbox escapes

Evidence notes

The vulnerability description and affected product information are sourced from the official NVD record and Chrome release notes. The vendor field indicates Apple with medium confidence based on CPE data, though the primary affected product is Google Chrome. The CPE criteria confirm Chrome versions prior to 147.0.7727.101 are vulnerable across multiple platforms including macOS, Linux, and Windows.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6302 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6302

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6302 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6302

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.