PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6315 Google CVE debrief

A use-after-free vulnerability in the Permissions component of Google Chrome on Android allows remote code execution through crafted HTML pages when users perform specific UI gestures. The vulnerability affects Chrome versions prior to 147.0.7727.101 on Android devices. Google has assigned this a High severity rating, with a CVSS 3.1 score of 8.8. The issue was initially published on April 15, 2026, and the CVE record was last modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Android device users, mobile security administrators, enterprise mobility teams, and organizations with BYOD policies should prioritize this update due to the high severity and potential for remote code execution through web browsing.

Technical summary

The vulnerability exists in the Permissions handling code of Google Chrome on Android, where a use-after-free condition can be triggered through specific user interactions with a malicious web page. The flaw requires user engagement with UI gestures, making it a user-assisted attack vector. Successful exploitation results in arbitrary code execution within the Chrome browser context. The underlying weakness is classified as CWE-416 (Use After Free), indicating improper memory management where a pointer to freed memory is dereferenced.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Android devices to version 147.0.7727.101 or later through the Google Play Store
  • Verify Chrome version by navigating to Settings > About Chrome and confirming the version number
  • Enable automatic app updates on Android devices to ensure timely security patch deployment
  • Review and restrict browser permissions for untrusted web applications
  • Monitor for unusual browser behavior or unexpected permission requests on Android devices
  • Apply enterprise mobile device management policies to enforce minimum Chrome version requirements

Evidence notes

Vulnerability confirmed through official Chrome release notes and Chromium issue tracker. CWE-416 (Use After Free) classification provided by Chrome security team. Affected versions confirmed through CPE criteria in NVD record.

Official resources

2026-04-15