PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6317 Google CVE debrief

A use-after-free vulnerability in the Cast component of Google Chrome prior to version 147.0.7727.101 enables remote code execution when a user visits a malicious HTML page. The vulnerability stems from improper memory management in the Cast implementation, where a freed object is subsequently accessed, potentially allowing an attacker to corrupt memory and execute arbitrary code within the browser process. Google has assigned this a High severity rating. The issue was disclosed on April 15, 2026, with the NVD record subsequently modified on May 26, 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Organizations with Chrome deployments, particularly those with users who may visit untrusted web content. Security teams responsible for browser security and patch management. Enterprises using Chrome's Cast functionality for presentations or media streaming.

Technical summary

The vulnerability exists in the Cast component of Google Chrome, where a use-after-free condition can be triggered through crafted HTML content. When memory containing a Cast object is freed and subsequently accessed, the dangling pointer may be exploited to achieve arbitrary code execution. The attack requires user interaction (visiting a malicious page) but is otherwise unauthenticated and remotely exploitable. The fix in Chrome 147.0.7727.101 addresses the underlying memory management flaw.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.101 or later immediately.
  • Verify Chrome version via chrome://settings/help and ensure automatic updates are enabled.
  • For managed environments, deploy the updated version through enterprise patch management systems.
  • Consider implementing site isolation policies and restricting execution of untrusted web content where feasible.
  • Monitor for anomalous browser crashes or unexpected Cast-related behavior as potential exploitation indicators.

Evidence notes

The CVE description and NVD CPE data confirm the vulnerability affects Google Chrome versions prior to 147.0.7727.101. The vendor field in the source data incorrectly lists Apple; the authoritative CPE criteria and description identify Google Chrome as the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) supports the 8.8 score with network attack vector, low complexity, and high impacts on confidentiality, integrity, and availability. CWE-416 (Use After Free) is identified as the weakness type.

Official resources

2026-04-15