Google Chrome CVE-2026-6300: Use After Free in CSS Layout Pipeline — Technical Breakdown with Patch Analysis

Introduction

A use after free in Google Chrome's CSS layout engine, patched on April 15, 2026, lets any website trigger remote code execution inside the browser's renderer sandbox by serving a crafted HTML page. Chrome holds roughly 66.7% of the global browser market, so the blast radius for unpatched environments is substantial. The fix is a subtle but instructive change to how Blink iterates over layout objects during style recalculation.

Technical information

CVE-2026-6300 is classified under CWE-416 (Use After Free) and has a CVSS score of 8.8 and a Chromium severity rating of High. The root cause is in Blink's LocalFrameView::PerformLayout() function, which walks the page's layout tree and processes the subtree roots that need work.

Root cause

During layout, the renderer iterates over layout_subtree_root_list_, a list of LayoutObject subtree roots that require processing. Interleaved style recalculation can be triggered in the middle of this iteration. CSS container queries, for example, re-evaluate when a container is resized during layout. That interleaved recalc can set an element to display:none, which destroys the underlying LayoutObject. If the destroyed object is one of the subtree roots being iterated, ClearLayoutSubtreeRoot() mutates the list mid-iteration. The iteration is left holding a dangling reference, and the result is a use after free.

Attack flow

Exploitation requires minimal user interaction:

1. The victim navigates to a malicious or compromised website.
2. The page contains CSS with container queries configured to trigger a resize during the layout pass.
3. The interleaved style recalculation destroys a LayoutObject that is still referenced in the subtree root iteration list.
4. The dangling pointer is dereferenced, enabling arbitrary code execution within the renderer sandbox.

The attack vector relies entirely on standard web content delivery, so any malicious or compromised website could serve the exploit payload. Execution stays inside Chrome's sandbox, which prevents direct OS-level access, but this class of vulnerability is commonly chained with sandbox escape bugs to achieve full system compromise.

Patch information

Google addressed CVE-2026-6300 in commit c34df82. Anders Hartvoll Ruud ([email protected]) authored it on April 7, 2026, and it was cherry-picked into the 7727 release branch from the original commit c215f8e6 on main. The fix shipped to users on April 15, 2026 in Chrome 147.0.7727.101/.102 (Windows/Mac) and 147.0.7727.101 (Linux). Morten Stenshorne reviewed the change in CL 7669842 (original) and CL 7735721 (cherry-pick).

The fix touches four files across three logical changes:

1. Iterate on a copy of the list (local_frame_view.cc)

The code no longer iterates directly over the live layout_subtree_root_list_.Ordered(). It copies the list into a local variable and iterates on the copy, and before processing each root it checks that the root still exists in the original list:

// BEFORE (vulnerable):
for (auto& root : layout_subtree_root_list_.Ordered()) {
  bool should_rebuild_fragments = false;
  LayoutObject& root_layout_object = *root;
  // ... processing ...
}

// AFTER (patched):
HeapVector<LayoutObjectWithDepth> ordered_roots =
    layout_subtree_root_list_.Ordered();
for (LayoutObjectWithDepth& root : ordered_roots) {
  LayoutObject& root_layout_object = *root;
  if (!layout_subtree_root_list_.Contains(root_layout_object)) {
    // A previous iteration removed the entry from the list.
    // This can happen when interleaved style recalc sets the element
    // associated the layout subtree root to display:none.
    continue;
  }
  bool should_rebuild_fragments = false;
  // ... processing ...
}

The copy-then-check pattern is deliberate. The commit message explains why a simpler std::move approach would not work: the original list has to stay intact so the code can detect which roots earlier iterations invalidated.

2. New Contains() helper (depth_ordered_layout_object_list.cc / .h)

To support that check, the patch adds a Contains() method to DepthOrderedLayoutObjectList:

bool DepthOrderedLayoutObjectList::Contains(LayoutObject& object) const {
  return Unordered().Contains(&object);
}

It delegates to the internal HeapHashSet<Member<LayoutObject>>, so the code can confirm with an O(1) lookup that a given LayoutObject is still a valid entry in the live list before using it.

3. Regression test

The patch adds a Web Platform Test crashtest under css/css-conditional/container-queries/crashtests/. It sets up a container query that turns a layout subtree root into display:none while layout is in progress, which is the exact trigger condition for the vulnerability. The test forces layout via document.body.offsetTop, mutates styles that resize a container (triggering the query), and forces layout again to confirm no crash occurs.

Affected systems and versions

All Google Chrome versions prior to 147.0.7727.101 on desktop platforms are affected. The patched versions are:

Any Chromium-based browser that incorporates the vulnerable Blink rendering engine code may also be affected, though specific version mappings for downstream browsers (Edge, Opera, Brave, etc.) depend on when they merge the upstream fix.

Vendor security history

Google handles vulnerability disclosure and patching through the Chromium project, which uses a rapid release cycle to push security updates to the Stable channel frequently. The CVE-2026-6300 timeline fits that pattern. The fix was authored on April 7, cherry-picked into the release branch, and shipped to users on April 15, an eight-day turnaround from code fix to public release. The Chromium issue tracker entry for bug 491994185 remains access restricted, which is standard practice for security bugs until a sufficient percentage of users have updated.

References

• NVD Entry for CVE-2026-6300
• CVE Record: CVE-2026-6300
• Chrome Stable Channel Update for Desktop (April 15, 2026)
• Chromium Issue 491994185
• Patch Commit c34df82
• Patch Diff
• CISA Known Exploited Vulnerabilities Catalog
• Update Google Chrome (Desktop)
• Chromium Blog: Speeding up Chrome's Release Cycle
• StatCounter Browser Market Share