PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6315 Google CVE debrief

A use-after-free vulnerability in the Permissions component of Google Chrome on Android allows remote code execution through crafted HTML pages when users perform specific UI gestures. The vulnerability affects Chrome versions prior to 147.0.7727.101 on Android devices. Google has assigned this a High severity rating, with a CVSS 3.1 score of 8.8. The issue was initially published on April 15, 2026, and the CVE record was last modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Android device users, mobile security administrators, enterprise mobility teams, and organizations with BYOD policies should prioritize this update due to the high severity and potential for remote code execution through web browsing.

Technical summary

The vulnerability exists in the Permissions handling code of Google Chrome on Android, where a use-after-free condition can be triggered through specific user interactions with a malicious web page. The flaw requires user engagement with UI gestures, making it a user-assisted attack vector. Successful exploitation results in arbitrary code execution within the Chrome browser context. The underlying weakness is classified as CWE-416 (Use After Free), indicating improper memory management where a pointer to freed memory is dereferenced.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Android devices to version 147.0.7727.101 or later through the Google Play Store
  • Verify Chrome version by navigating to Settings > About Chrome and confirming the version number
  • Enable automatic app updates on Android devices to ensure timely security patch deployment
  • Review and restrict browser permissions for untrusted web applications
  • Monitor for unusual browser behavior or unexpected permission requests on Android devices
  • Apply enterprise mobile device management policies to enforce minimum Chrome version requirements

Evidence notes

Vulnerability confirmed through official Chrome release notes and Chromium issue tracker. CWE-416 (Use After Free) classification provided by Chrome security team. Affected versions confirmed through CPE criteria in NVD record.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6315 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6315

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6315 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6315

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.