CVE-2026-6359: Google Chrome Use After Free Vulnerability

CVE-2026-6359 Overview

CVE-2026-6359 is a use-after-free vulnerability affecting the Video component in Google Chrome on Windows. This memory corruption flaw allows a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access through a specially crafted HTML page. Chromium has rated the security severity of this vulnerability as High.

Critical Impact

Remote attackers with compromised renderer access can exploit this use-after-free condition to execute arbitrary code, potentially leading to full system compromise on affected Windows systems running vulnerable Chrome versions.

Affected Products

• Google Chrome on Windows prior to version 147.0.7727.101
• Chromium-based browsers on Windows using vulnerable Video component versions

Discovery Timeline

• 2026-04-15 - CVE-2026-6359 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-6359

Vulnerability Analysis

This vulnerability is classified as CWE-416: Use After Free. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it references has been freed. In this case, the flaw exists within the Video component of Google Chrome, where memory associated with video processing objects can be accessed after being deallocated.

When exploited, this vulnerability enables out-of-bounds memory access, which can be leveraged by attackers to read or write arbitrary memory locations. The exploitation requires the attacker to have first compromised the renderer process, making this a sandbox escape scenario. Once the renderer is compromised, the attacker can craft malicious HTML content that triggers the use-after-free condition in the Video component.

Root Cause

The root cause lies in improper memory management within Chrome's Video component on Windows. When video-related objects are freed, references to those objects are not properly invalidated, allowing subsequent operations to access the freed memory region. This dangling pointer condition creates an exploitable window where an attacker can manipulate memory allocation to control the contents of the freed memory, enabling code execution or information disclosure.

Attack Vector

The attack requires the following conditions:

1. Renderer Compromise: The attacker must first gain control over Chrome's renderer process through a separate vulnerability
2. Crafted HTML Page: A malicious HTML page containing video elements designed to trigger the use-after-free condition
3. User Interaction: The victim must visit or be redirected to the attacker-controlled page
4. Windows Platform: Only Windows installations of Chrome are affected by this specific vulnerability

The network-based attack vector means exploitation can occur remotely when users browse to malicious content. The requirement for renderer compromise indicates this is likely part of a multi-stage attack chain.

Detection Methods for CVE-2026-6359

Indicators of Compromise

• Unusual memory access patterns or crashes within Chrome's GPU or Video processes
• Unexpected network connections from Chrome processes to unknown external hosts
• Chrome crash reports indicating access violations in video-related components
• Suspicious HTML or JavaScript content designed to manipulate video elements

Detection Strategies

• Monitor for Chrome browser crashes with stack traces referencing Video component functions
• Implement endpoint detection rules to identify anomalous Chrome renderer process behavior
• Deploy network monitoring to detect access to known malicious domains serving exploit code
• Analyze browser telemetry for repeated attempts to load crafted video content

Monitoring Recommendations

• Enable Chrome's built-in crash reporting and review reports for patterns indicating exploitation attempts
• Configure SentinelOne agents to detect memory corruption exploitation techniques
• Monitor for privilege escalation attempts following Chrome process anomalies
• Track Chrome version deployment across the organization to identify unpatched systems

How to Mitigate CVE-2026-6359

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.101 or later immediately
• Enable automatic Chrome updates to receive security patches promptly
• Consider restricting access to untrusted websites until patching is complete
• Review endpoint security logs for any signs of exploitation attempts

Patch Information

Google has released a security update addressing this vulnerability. The fix is included in Chrome version 147.0.7727.101 and later. Administrators should deploy this update across all managed Chrome installations. For detailed patch information, refer to the Google Chrome Stable Update announcement. Additional technical details can be found in the Chromium Issue Tracker #490251701.

Workarounds

• Disable or restrict video playback in Chrome using enterprise policies until patching is feasible
• Implement strict Content Security Policy (CSP) headers on internal web applications
• Use browser isolation solutions to contain potential renderer compromises
• Consider temporarily using alternative browsers on high-value systems if immediate patching is not possible

# Configuration example - Chrome Enterprise Policy to force updates
# Deploy via Group Policy or Chrome Browser Cloud Management

# Force Chrome to update and restart
# Set update policy to require latest version
# registry key: HKLM\SOFTWARE\Policies\Google\Update
# TargetVersionPrefix = "147.0.7727.101"
# UpdateDefault = 1 (Always allow updates)