PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6359 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Video component on Windows, prior to version 147.0.7727.101, allows remote attackers to perform out-of-bounds memory access via a crafted HTML page. This issue, tracked as CVE-2026-6359, was publicly disclosed on April 15, 2026, and last modified on October 26, 2026. The vulnerability has a CVSS score of 8.8 and is considered High severity by Chromium.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-10-26
Advisory published
2026-04-15
Advisory updated
2026-10-26

Who should care

Defenders responsible for managing Google Chrome deployments on Windows, particularly in environments where users access untrusted or malicious websites, should assess exposure and apply patches.

Why it matters

CVE-2026-6359 is a high-severity use-after-free vulnerability in Google Chrome's Video component on Windows. Defenders should assess exposure, apply patches, and monitor for suspicious activity. The vulnerability allows remote attackers to perform out-of-bounds memory access via a crafted HTML page. Verification of version information and patching are crucial to addressing the vulnerability.

  • Remote attackers may perform out-of-bounds memory access
  • Potential for code execution or data theft requires verification
  • Defenders must verify Google Chrome version information
  • Patching is required to address the vulnerability

Technical summary

The CVE-2026-6359 vulnerability is a use-after-free issue in Google Chrome's Video component on Windows. It allows remote attackers to perform out-of-bounds memory access via a crafted HTML page. The vulnerability has a CVSS score of 8.8 and is considered High severity by Chromium. It affects Google Chrome versions prior to 147.0.7727.101.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Google Chrome on Windows, particularly in environments where users access untrusted or malicious websites.

Recommended defensive actions

  • Assess exposure of Google Chrome on Windows to CVE-2026-6359
  • Apply patches for Google Chrome version 147.0.7727.101 or later
  • Monitor for suspicious HTML page activity
  • Verify version information for Google Chrome on Windows

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score, severity, and affected versions. Vendor advisories and issue tracking links are also available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6359 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6359

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6359 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6359

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.