Introduction
A type confusion flaw in Chrome's Turbofan JIT compiler gives remote attackers a path to arbitrary code execution inside the renderer sandbox. The victim only has to visit a malicious webpage. Chrome holds roughly 66.7 percent of the global browser market, so CVE-2026-6307 is a large attack surface, and security teams need to address it promptly across desktop and mobile fleets.
Technical Information
Root Cause: Speculative Optimization Gone Wrong
The vulnerability is in Turbofan, V8's optimizing just-in-time compiler. Turbofan compiles frequently executed ("hot") JavaScript functions into highly optimized machine code. It does this through speculative optimization: it profiles runtime behavior, makes assumptions about variable types, and strips expensive type-check guards from the generated code. When those speculative type assumptions hold, execution is fast. When they are violated, the engine is supposed to deoptimize and fall back to the safe interpreter path.
CVE-2026-6307 is a type confusion bug (CWE-843). Turbofan's speculative type assumptions are violated at runtime, but the compiler fails to trigger the expected deoptimization. The generated machine code then operates on an object using the wrong type layout. Different object types differ in size, field offsets, and semantics, so this mismatch corrupts memory in a potentially controlled way and gives an attacker a primitive for arbitrary code execution.
Earlier Turbofan type confusion bugs, such as CVE-2025-2135 and CVE-2020-16009, share the same root cause pattern: incorrect type inference or map-tracking logic that fails to install or honor proper deoptimization guards.
Attack Flow
From the victim's side, the exploitation path is simple:
- An attacker crafts an HTML page containing JavaScript designed to trigger the faulty type inference path in Turbofan.
- A user visits the page (or is redirected to it via advertising, phishing, or a compromised legitimate site).
- The V8 engine profiles the attacker's JavaScript and eventually compiles it through Turbofan's optimizing pipeline.
- The type confusion occurs during JIT compilation. The resulting optimized code mishandles object types, and the attacker gains a controlled memory-corruption primitive.
- The attacker uses this primitive to execute arbitrary code within Chrome's renderer sandbox.
The attack needs no special user privileges and no interaction beyond visiting the page. Execution is confined to the renderer sandbox. That limits direct host-level compromise, but it still exposes data within the browser context: cookies, session tokens, rendered page content, and potentially credentials entered on other tabs that share the same renderer process. Chained with a separate sandbox escape vulnerability, the bug can lead to full system compromise.
Discovery Timeline
| Milestone | Date |
|---|---|
| Reported by Project WhatForLunch | March 29, 2026 |
| Stable channel fix released | April 15, 2026 |
| NVD publication | April 15, 2026 |
Google shipped the stable fix 17 days after the report. That turnaround reflects how critical the vulnerability is and how efficient Google's response process is.
Patch Information
Google fixed CVE-2026-6307 in a Stable Channel update for desktop released on April 15, 2026. The fix shipped in Chrome version 147.0.7727.101 for Linux and 147.0.7727.101/102 for Windows and Mac. This update landed roughly one week after the initial Chrome 147 stable release (147.0.7727.49/.50), which went out on April 7, 2026.
The exact code-level changes are not public yet. Access to the associated Chromium bug tracker entry (issue 497404188) is currently restricted, which is standard practice for Chrome security bugs. Google typically keeps issue details under embargo until a sufficient percentage of users have received the patched version.
If this fix follows the pattern of similar Turbofan type confusion fixes (such as CVE-2025-2135 and CVE-2020-16009), the patch likely corrects faulty type inference or map-tracking logic in Turbofan so that the engine deoptimizes properly when the compiler's type assumptions are invalidated. Past fixes in this area have added or corrected CheckMaps guards, fixed InferMapsUnsafe() traversal logic, or installed proper CodeDependency hooks so that JIT-compiled code is deoptimized when object maps change unexpectedly.
Fixed Versions by Platform
| Platform | Fixed Version |
|---|---|
| Windows | 147.0.7727.101 or 147.0.7727.102 |
| Mac | 147.0.7727.101 or 147.0.7727.102 |
| Linux | 147.0.7727.101 |
| Android | 147.0.7727.101 (rolling out via Google Play) |
The stable channel update rolls out over days to weeks, so administrators should not rely on automatic updates alone. They should verify version compliance manually across the fleet.
CVE-2026-6307 also affects all downstream Chromium-based browsers, including Microsoft Edge, Brave, and Opera. Each of those products has to ingest the upstream Chromium fix and release its own update, so security teams should track those downstream advisories independently.
Affected Systems and Versions
The vulnerability affects all Google Chrome versions before 147.0.7727.101 on every desktop platform (Windows, Mac, Linux) and on Android. Specifically:
- Windows and Mac: versions prior to 147.0.7727.101/102
- Linux: versions prior to 147.0.7727.101
- Android: versions prior to 147.0.7727.101
Chromium-based browsers that include the affected V8 engine version stay vulnerable until they ship their own updates with the upstream fix.
Vendor Security History
Google runs a mature, well-resourced vulnerability disclosure program for Chrome and credits external researchers for their findings. Project WhatForLunch reported this vulnerability on March 29, 2026. Google deliberately restricts bug details until a majority of users have updated, so that adversaries cannot reverse-engineer patches before the ecosystem is secure.
Type confusion in Turbofan is a recurring vulnerability class in Chrome's history. Notable earlier cases include CVE-2025-2135 and CVE-2020-16009, both of which involved similar root cause patterns in V8's JIT compilation pipeline. More recently, Google confirmed active exploitation of CVE-2026-5281, another Chrome vulnerability, which shows that adversaries remain interested in browser-level attack surfaces.
