CVE-2026-6358: Google Chrome XR Use-After-Free Flaw

CVE-2026-6358 Overview

CVE-2026-6358 is a Use After Free vulnerability affecting the XR (Extended Reality) component in Google Chrome on Android. This memory corruption flaw exists in versions prior to 147.0.7727.101 and allows a remote attacker to perform an out-of-bounds memory read through a specially crafted HTML page. The Chromium security team has classified this vulnerability with Critical severity, indicating significant potential for exploitation in real-world attack scenarios.

Use After Free vulnerabilities occur when a program continues to use memory after it has been freed, potentially allowing attackers to manipulate the freed memory region to achieve arbitrary code execution or information disclosure. In this case, the vulnerability resides in the XR subsystem responsible for handling Extended Reality (WebXR) features in Chrome.

Critical Impact
Remote attackers can exploit this vulnerability to perform out-of-bounds memory reads, potentially leading to information disclosure or arbitrary code execution by tricking users into visiting a malicious webpage.

Affected Products

Google Chrome for Android prior to version 147.0.7727.101
Chromium-based browsers utilizing the vulnerable XR component
WebXR-enabled applications built on affected Chrome versions

Discovery Timeline

April 15, 2026 - CVE-2026-6358 published to NVD
April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6358

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a critical class of memory corruption bugs that frequently lead to exploitable conditions in browser environments. The flaw resides specifically within Chrome's XR (Extended Reality) implementation, which handles WebXR Device API functionality for immersive virtual and augmented reality experiences.

When a user visits a maliciously crafted webpage, the attacker can trigger a condition where the XR component references memory that has already been deallocated. This dangling pointer can then be exploited to read memory contents beyond the intended boundaries, potentially exposing sensitive information or allowing manipulation of program execution flow.

Browser-based Use After Free vulnerabilities are particularly dangerous because they can be triggered remotely without any user interaction beyond visiting a webpage. The attack requires no special privileges and operates over the network, making it an attractive target for drive-by download campaigns and watering hole attacks.

Root Cause

The root cause of CVE-2026-6358 lies in improper memory management within the XR component of Google Chrome. Specifically, the vulnerability occurs when an object related to XR session handling is freed but a reference to that memory location is retained and subsequently accessed. This creates a temporal safety violation where the program's assumptions about memory state become invalid.

The XR subsystem manages complex state for Extended Reality sessions, including device tracking, rendering contexts, and input handling. The complexity of this state management, combined with the asynchronous nature of WebXR operations, creates opportunities for race conditions and improper object lifecycle management that can manifest as Use After Free conditions.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker would need to:

Create a malicious HTML page containing crafted WebXR API calls designed to trigger the Use After Free condition
Lure a victim to visit the malicious webpage using Google Chrome on an Android device
Exploit the memory corruption to perform out-of-bounds reads

The vulnerability can be triggered through standard web browsing without requiring any additional user actions beyond page navigation. This makes it suitable for phishing campaigns, malvertising, or compromise of legitimate websites to serve malicious content.

The exploitation mechanism involves manipulating the timing and sequence of WebXR API calls to create a state where freed memory is accessed. Due to the complexity of browser memory allocation, successful exploitation may require heap grooming techniques to place controlled data in the freed memory region.

Detection Methods for CVE-2026-6358

Indicators of Compromise

Unusual WebXR API activity or session creation patterns in browser logs
Chrome crash reports indicating memory access violations in XR-related components
Network traffic to known malicious domains hosting exploit pages targeting WebXR vulnerabilities
Abnormal memory consumption patterns in Chrome's GPU or renderer processes

Detection Strategies

Monitor Chrome version across endpoints and flag any installations running versions prior to 147.0.7727.101
Implement browser isolation solutions to contain potential exploitation of browser-based vulnerabilities
Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption exploitation attempts
Utilize web filtering to block access to known malicious domains serving browser exploits

Monitoring Recommendations

Enable Chrome's enhanced safe browsing mode to receive real-time protection against emerging threats
Monitor for suspicious child process spawning from Chrome browser processes
Implement centralized logging for browser crash reports to identify potential exploitation attempts
Review network connections initiated by Chrome processes for connections to suspicious infrastructure

How to Mitigate CVE-2026-6358

Immediate Actions Required

Update Google Chrome on all Android devices to version 147.0.7727.101 or later immediately
Enable automatic updates for Chrome to ensure timely application of security patches
Consider temporarily disabling WebXR functionality in enterprise environments until patching is complete
Implement network-level controls to block known malicious domains targeting this vulnerability

Patch Information

Google has addressed this vulnerability in Chrome version 147.0.7727.101 for Android. Organizations should prioritize updating all Chrome installations to this version or later. The patch information is available through the Google Chrome Update Announcement.

Additional technical details about the vulnerability fix can be found in the Chromium Issue Tracker Entry. Enterprise administrators using Chrome Enterprise can leverage managed browser policies to enforce version requirements and automatic updates.

Workarounds

Disable WebXR Device API through Chrome flags (chrome://flags/#webxr) as a temporary mitigation until patching is possible
Implement strict content security policies (CSP) on internal web applications to limit exposure to malicious scripts
Use browser isolation or sandboxing solutions to contain potential exploitation
Consider restricting Chrome usage to trusted sites only in high-security environments until updates are applied

bash

# Chrome Enterprise Policy Configuration for Update Enforcement
# Add to Chrome enterprise policy to ensure minimum version requirements

# Windows Registry (HKLM\SOFTWARE\Policies\Google\Chrome)
# MinimumChromeVersionEnforced = "147.0.7727.101"

# Linux/macOS managed preferences
# Set MinimumChromeVersionEnforced to enforce minimum version
# Configure AutoUpdateCheckPeriodMinutes for update frequency

# Example Chrome policy JSON snippet
# {
#   "MinimumChromeVersionEnforced": "147.0.7727.101",
#   "AutoUpdateCheckPeriodMinutes": 60,
#   "RelaunchNotification": 2
# }