CVE-2026-6360: Google Chrome Use After Free Vulnerability

CVE-2026-6360 Overview

CVE-2026-6360 is a Use After Free vulnerability in the FileSystem component of Google Chrome prior to version 147.0.7727.101. This memory corruption flaw allows a remote attacker to potentially exploit object corruption via a crafted HTML page, enabling arbitrary code execution within the browser context. The vulnerability is classified as high severity by the Chromium security team.

Critical Impact

Remote attackers can exploit this Use After Free vulnerability to achieve arbitrary code execution by luring victims to malicious web pages, potentially leading to complete system compromise.

Affected Products

• Google Chrome prior to 147.0.7727.101
• Chromium-based browsers using affected FileSystem component
• All platforms running vulnerable Chrome versions (Windows, macOS, Linux)

Discovery Timeline

• 2026-04-15 - CVE-2026-6360 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-6360

Vulnerability Analysis

This vulnerability is a classic Use After Free (CWE-416) memory corruption issue affecting the FileSystem API implementation in Google Chrome. Use After Free vulnerabilities occur when a program continues to use a pointer after the memory it references has been freed. In the context of Chrome's FileSystem component, this allows attackers to manipulate freed memory regions and potentially corrupt objects in memory.

The FileSystem API provides web applications with a sandboxed file system for reading and writing files. When the underlying memory management improperly handles object lifecycles during file system operations, an attacker can craft malicious HTML content that triggers the premature deallocation of memory while references to that memory still exist. Subsequent operations on these dangling pointers can lead to object corruption.

Root Cause

The root cause lies in improper memory lifecycle management within Chrome's FileSystem implementation. When certain file system operations are performed in a specific sequence, the browser fails to properly track object references before deallocating memory. This creates a race condition where freed memory can be accessed through stale pointers, leading to exploitable object corruption.

The vulnerability is classified under CWE-416 (Use After Free), indicating that the code references memory after it has been freed, which can lead to program crashes, unexpected values, or code execution when the freed memory is reallocated and overwritten with attacker-controlled data.

Attack Vector

The attack requires user interaction—specifically, a victim must navigate to a malicious webpage containing the crafted HTML payload. Once the page loads, the exploit triggers the Use After Free condition in the FileSystem component. The attacker can then leverage heap manipulation techniques to control the contents of the freed memory region, ultimately achieving arbitrary code execution within the Chrome renderer process.

The vulnerability is exploitable over the network and requires no privileges on the target system beyond convincing a user to visit the malicious page. Successful exploitation could allow attackers to execute arbitrary code with the privileges of the browser process, potentially leading to information theft, malware installation, or further system compromise.

Due to the sensitive nature of this vulnerability and to protect users, specific exploitation details and proof-of-concept code are not provided. Technical details may be available through the Chromium Issue Tracker Entry once the vulnerability is sufficiently patched across the user base.

Detection Methods for CVE-2026-6360

Indicators of Compromise

• Unexpected Chrome crashes or instability, particularly when interacting with web pages utilizing FileSystem APIs
• Memory access violations or corruption errors in Chrome crash reports referencing FileSystem components
• Suspicious HTML pages containing complex FileSystem API calls with unusual timing patterns

Detection Strategies

• Monitor endpoint systems for Chrome versions below 147.0.7727.101 using asset management tools
• Implement browser-based threat detection to identify malicious JavaScript patterns targeting FileSystem APIs
• Deploy network monitoring to detect connections to known malicious domains serving exploit code
• Enable Chrome's crash reporting to identify potential exploitation attempts through crash patterns

Monitoring Recommendations

• Configure SIEM alerts for Chrome crash events that reference memory corruption in FileSystem modules
• Monitor web proxy logs for suspicious HTML content with embedded FileSystem API manipulation
• Track browser version compliance across the organization to identify unpatched installations
• Review endpoint detection logs for post-exploitation indicators following browser-based attacks

How to Mitigate CVE-2026-6360

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.101 or later immediately across all endpoints
• Enable automatic updates for Chrome to ensure timely patching of future vulnerabilities
• Consider implementing browser isolation technologies for high-risk users until patching is complete
• Educate users about the risks of visiting untrusted websites during the vulnerability window

Patch Information

Google has released Chrome version 147.0.7727.101 which addresses this vulnerability. Organizations should prioritize updating all Chrome installations to this version or later. The official release announcement is available through the Google Chrome Releases Blog.

For enterprise deployments, administrators can use Chrome Enterprise policies to enforce automatic updates or deploy the patched version through software distribution systems.

Workarounds

• If immediate patching is not possible, consider temporarily restricting access to untrusted websites through web filtering
• Enable Chrome's Site Isolation feature to limit the impact of renderer process compromises
• Deploy endpoint detection and response (EDR) solutions to detect and block exploitation attempts
• Consider using alternative browsers temporarily until Chrome can be updated in environments where patching delays are unavoidable

# Verify Chrome version on Linux/macOS
google-chrome --version

# Enterprise deployment: Force Chrome update via command line
# Windows (run as administrator)
# "C:\Program Files\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1

# macOS: Check for updates
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version