Introduction
A use-after-free vulnerability in Google Chrome's Video component gives remote attackers a path to arbitrary code execution inside the browser sandbox. All the attacker needs is for a victim to click a link to a crafted HTML page. Chrome runs on roughly two thirds of all browsers worldwide, so CVE-2026-6302, with a CVSS 3.1 score of 8.8, is a real risk for virtually every organization.
Technical Information
The root cause of CVE-2026-6302 is a use-after-free condition (CWE-416) in Chrome's Video component. A use after free occurs when application code dereferences a pointer to memory that has already been freed and possibly reallocated for a different purpose. This class of bug is particularly dangerous in a browser, because the attacker can influence heap layout through JavaScript and DOM manipulation. That makes it more likely that the freed memory gets reclaimed with attacker-controlled data.
The CVSS 3.1 vector breaks down as follows:
| Metric | Value | Description |
|---|---|---|
| Base Score | 8.8 | High severity |
| Attack Vector | Network | Exploitable over the internet |
| Attack Complexity | Low | No specialized access conditions required |
| Privileges Required | None | Attacker needs no prior authentication |
| User Interaction | Required | Victim must visit a crafted HTML page |
| Scope | Unchanged | Remains within the vulnerable component |
| Confidentiality Impact | High | Total loss of information within context |
| Integrity Impact | High | Total compromise of data integrity |
| Availability Impact | High | Complete denial of service within context |
Attack Flow
An attack would proceed as follows:
- The attacker builds a malicious HTML page that triggers specific Video component behavior in Chrome and causes a memory object to be freed prematurely.
- The attacker uses heap-shaping techniques (commonly JavaScript typed arrays or other allocator-friendly objects) to reclaim the freed memory with controlled content.
- When Chrome's Video component later accesses the dangling pointer, it operates on attacker-controlled data, which enables arbitrary code execution.
- The attacker lures the victim to the page through phishing, malvertising, or a payload embedded in an iframe on a compromised site.
- Code runs within the Chrome renderer sandbox. The sandbox limits the blast radius, but inside that context the attacker has full control, with high impact to confidentiality, integrity, and availability.
Security researcher Syn4pse reported the vulnerability on March 24, 2026. Google has restricted access to the specific bug details and related links until a majority of users have received the update. This is standard practice, and it shortens the window for reverse engineering and exploit development.
Affected Systems and Versions
All Google Chrome versions before 147.0.7727.101 are affected. The fixed versions by operating system are:
| Operating System | Minimum Secure Version |
|---|---|
| Windows | 147.0.7727.101 or 147.0.7727.102 |
| Mac | 147.0.7727.101 or 147.0.7727.102 |
| Linux | 147.0.7727.101 |
Any Chromium-based browser that includes the vulnerable Video component code may also be affected. Which versions of downstream browsers (Edge, Brave, Opera, etc.) carry the fix will depend on each vendor's update schedule.
Vendor Security History
Chrome's security record reflects both the size of its attack surface and the maturity of Google's defenses. The Chromium project uses AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to find memory corruption issues proactively. Its Vulnerability Rewards Program rewards external researchers for reporting bugs responsibly.
Chrome is still a high-value target. The April 15, 2026, stable channel update that fixed CVE-2026-6302 included 31 distinct security fixes. More critically, at least two other Chrome vulnerabilities were confirmed as exploited in the wild in March 2026:
| Vulnerability ID | Component | Reported Date | In the Wild Exploitation |
|---|---|---|---|
| CVE-2026-6302 | Video | March 24, 2026 | None reported currently |
| CVE-2026-5281 | Dawn | March 31, 2026 | Confirmed by Google |
| CVE-2026-3910 | Unknown | March 10, 2026 | Confirmed by Google |
Attackers have been quick to weaponize Chrome memory corruption flaws, so treat CVE-2026-6302 as a high-priority fix even though no exploitation has been confirmed.
References
- NVD Entry for CVE-2026-6302
- MITRE CVE Record for CVE-2026-6302
- Chrome Stable Channel Update for Desktop (April 15, 2026)
- Chromium Issue Tracker: Issue 495477995
- Chrome Stable Channel Update for Desktop (March 31, 2026)
- Chrome Stable Channel Update for Desktop (March 12, 2026)
- Chromium Security Overview
- StatCounter Browser Market Share
- TheHackerWire: CVE-2026-6302
