CVE-2026-6314: Google Chrome RCE Vulnerability

CVE-2026-6314 Overview

CVE-2026-6314 is an out-of-bounds write vulnerability [CWE-787] in the GPU component of Google Chrome prior to version 147.0.7727.101. A remote attacker who has already compromised the GPU process can use a crafted HTML page to potentially escape the Chrome sandbox. Sandbox escape moves an attacker from a constrained renderer or GPU process into the broader operating system context, where additional code execution and persistence become feasible. Google rates the Chromium security severity as High. The vulnerability affects Chrome on Windows, macOS, and Linux. Exploitation requires user interaction, such as visiting an attacker-controlled web page, and depends on chaining with a prior GPU process compromise.

Critical Impact
Successful exploitation allows an attacker who already controls the Chrome GPU process to break out of the sandbox and execute code in a higher-privilege context across Windows, macOS, and Linux endpoints.

Affected Products

Google Chrome versions prior to 147.0.7727.101
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that inherit the unpatched GPU code path

Discovery Timeline

2026-04-15 - CVE-2026-6314 published to the National Vulnerability Database (NVD)
2026-04-15 - Google publishes the Stable Channel Update for Desktop addressing the issue
2026-04-17 - Last updated in the NVD database

Technical Details for CVE-2026-6314

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Chrome's GPU process. The GPU process in Chrome handles graphics acceleration, WebGL, WebGPU, video decoding, and compositing, and runs in its own sandboxed process separate from the renderer. When the GPU process writes beyond an allocated buffer boundary, attacker-controlled data can overwrite adjacent memory, including function pointers, vtables, or sandbox policy state.

This flaw is a sandbox-escape primitive rather than an initial entry point. The attacker must first compromise the GPU process, typically by chaining a separate renderer or GPU bug delivered through a crafted HTML page. With control of the GPU process, the out-of-bounds write then allows the attacker to corrupt structures that the broker process trusts, breaking the isolation boundary.

Details are tracked in the Chromium Issue Tracker entry 498782145.

Root Cause

The root cause is missing or insufficient bounds checking on a write operation inside the GPU process. The affected code path accepts size or index input that is not properly validated against the destination buffer length, producing a linear or indexed write past the allocation.

Attack Vector

The attack vector is network-based and requires user interaction. A victim visits a malicious or compromised web page that delivers content designed to first compromise the GPU process and then trigger the out-of-bounds write. The scope is changed because impact crosses the sandbox boundary, with high impact to confidentiality, integrity, and availability.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing is associated with CVE-2026-6314 at the time of publication.

Detection Methods for CVE-2026-6314

Indicators of Compromise

Chrome GPU process (chrome.exe --type=gpu-process on Windows, equivalent on macOS and Linux) crashing repeatedly or spawning unexpected child processes
Child processes of the Chrome GPU process executing shells, scripting interpreters, or LOLBins such as cmd.exe, powershell.exe, bash, or osascript
Outbound network connections originating from Chrome helper processes to uncategorized or newly registered domains following a browsing session

Detection Strategies

Build endpoint detections that flag any non-standard child process created by a Chrome GPU helper process, since the GPU process should not spawn interactive shells or system binaries.
Correlate Chrome crash telemetry with subsequent file write, registry modification, or persistence activity on the same host within a short time window.
Inventory installed Chrome versions across the fleet and alert on any host running a build older than 147.0.7727.101.

Monitoring Recommendations

Forward Chrome crash reports, process creation events, and EDR telemetry into a centralized data lake for cross-host correlation.
Monitor for anomalous WebGL or WebGPU activity volume from individual users, which can precede GPU-process exploitation attempts.
Track browser version compliance as a continuous metric and treat downgrade events as suspicious.

How to Mitigate CVE-2026-6314

Immediate Actions Required

Update Google Chrome to version 147.0.7727.101 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded into memory.
Update all Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, once their vendors ship the upstream fix.

Patch Information

Google addressed CVE-2026-6314 in the Chrome Stable channel build 147.0.7727.101. Refer to the Google Chrome Update Announcement for the full advisory. Enterprises managing Chrome via group policy or MDM should force the update and verify the deployed version across managed devices.

Workarounds

Restrict browsing to trusted sites until patches are deployed, using web filtering or DNS controls.
Disable hardware acceleration in Chrome (Settings > System > Use graphics acceleration when available) to reduce GPU process exposure, accepting the performance trade-off.
Enforce site isolation and the Chrome enterprise policy SitePerProcess to limit cross-origin data exposure if the GPU process is compromised.

bash

# Verify Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 147.0.7727.101 or later