PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6360 Google CVE debrief

A use-after-free vulnerability in Google Chrome's FileSystem component, rated High severity by Chromium security, allows remote attackers to potentially exploit object corruption via crafted HTML pages. The vulnerability affects Chrome versions prior to 147.0.7727.101. The use-after-free condition (CWE-416) in browser FileSystem handling presents significant risk as it could enable code execution in the context of the browser process. Google addressed this in the April 2026 stable channel security update. Organizations should prioritize updating Chrome installations to version 147.0.7727.101 or later.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Organizations with Chrome deployments, security teams managing browser security posture, endpoint protection administrators, and users handling sensitive web-based applications should prioritize this update. The vulnerability is particularly relevant for environments where users access untrusted web content or where Chrome is used for business-critical applications.

Technical summary

The vulnerability exists in Chrome's FileSystem implementation where improper memory management can lead to a use-after-free condition. When processing specially crafted HTML pages, the browser may reference freed memory objects, potentially resulting in object corruption and subsequent code execution. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, no privileges required, but user interaction required (typically visiting a malicious page). The confidentiality, integrity, and availability impacts are all rated High. This vulnerability class is frequently targeted in browser exploitation chains and drive-by download attacks.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.101 or later across all endpoints
  • Verify Chrome auto-update is enabled and functioning in enterprise environments
  • Review browser extension policies to reduce attack surface from untrusted web content
  • Monitor for anomalous browser crashes or unexpected process behavior that may indicate exploitation attempts
  • Apply security updates for other Chromium-based browsers (Edge, Brave, Opera) once vendor patches are available

Evidence notes

CVE published 2026-04-15; modified 2026-05-26. Vendor advisory confirms fix in Chrome 147.0.7727.101. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6360 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6360

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6360 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6360

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.