Quick Look: CVE-2026-6309, Use After Free in Google Chrome Viz Enables Sandbox Escape

Introduction

A use after free in Chrome's Viz compositor, the single process that combines frames from every renderer into the final display output, can let an attacker who already controls a renderer process break out of the sandbox entirely. Chrome held 66.7 percent of the global browser market as of March 2026, so the exposure for CVE-2026-6309 covers the majority of enterprise endpoints and consumer devices worldwide.

Google shipped a fix on April 15, 2026 in Chrome 147.0.7727.101/102, along with 30 other security fixes. The vulnerability has a CVSS 3.1 base score of 8.3 (HIGH). The bug tracker entry is still locked, so exploit details are not public yet, though patch diffing is likely already underway.

Technical Information

Root Cause: Use After Free in the Viz Compositor

CVE-2026-6309 is a use after free (CWE-416) in Chrome's Viz component. Viz is the client library and service implementation for compositing and GPU presentation within Chromium. Chromium uses multiple CPU processes for performance and security isolation, but it runs exactly one Viz process. That process aggregates compositing from multiple render processes and the browser process, then rasters and draws using the GPU.

Viz operates at a higher privilege level than individual renderer processes. It runs in the browser process context and has access to cross-origin visual data. Chromium puts Viz in its own process for stability and for security isolation from GPU hardware, but that design also means a memory corruption bug in Viz can bridge the gap between the sandboxed renderer and the more privileged browser process.

The underlying flaw is an object lifetime management error, where a memory region is freed while a pointer to it remains active. When the dangling pointer is later dereferenced, the attacker can influence what data occupies that memory region and may gain control of execution flow within the Viz process.

Attack Flow

Exploiting CVE-2026-6309 takes two stages:

1. Renderer compromise: The attacker first needs code execution within a Chrome renderer process. This step is a separate prerequisite that CVE-2026-6309 does not cover. An attacker can compromise a renderer through other vulnerabilities, such as type confusions in V8 or Turbofan, heap overflows in PDFium, or other memory corruption bugs. The same April 15 release fixes several such vulnerabilities (CVE-2026-6305 in PDFium, CVE-2026-6307 in Turbofan, CVE-2026-6308 in Media), any of which could in theory be the first link in a chain.

2. Sandbox escape via Viz: With a foothold in the renderer, the attacker delivers a specially crafted HTML page that triggers the use-after-free condition in the Viz component. Because Viz aggregates compositor frames from all renderers and runs with browser-process-level privileges, a successful exploit lets the attacker escape the renderer sandbox. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) records this scope change from renderer to browser process, along with high impact to confidentiality, integrity, and availability.

Attack complexity is rated High because the attack needs the prior renderer compromise. User interaction is also required (the victim must navigate to the crafted HTML page or be served it). Even so, the scope change and full CIA impact make this a serious escalation primitive.

Adjacent Vulnerabilities in the Same Release

The April 15, 2026 update includes 31 security fixes. These High-severity issues were fixed in the same release as CVE-2026-6309:

With High-severity bugs spread across this many components, the complete update needs to be deployed. Several of them could provide the initial renderer compromise that CVE-2026-6309 requires.

Patch Information

Google fixed CVE-2026-6309 in the Chrome Stable channel update released on April 15, 2026. The patched versions are:

This was a mid-cycle security patch within the Chrome 147 release train. It is separate from the initial Chrome 147 launch (147.0.7727.55/56, released April 7, 2026), which fixed 60 vulnerabilities.

The fix is tracked under Chromium issue 497846428, which is still access restricted. That matches Google's standard practice of keeping security bug details confidential until users have had enough time to update. The specific commit has not been publicly linked yet, so the exact code-level diff is not available to inspect.

At a high level, the patch corrects the object lifetime management flaw in the Viz compositor that let a still-active pointer reference a freed memory region. When Chromium fixes a use after free in its display and compositor subsystems, the fix typically makes sure that surface references and frame sink resources are properly invalidated, and that any pointers into compositor data structures are nulled, before the underlying memory is released. The same pattern runs through the many compositor UAF fixes Chrome has shipped over the years (for example, CVE-2024-4671, also a use after free in the Visuals/Viz layer).

To verify you are protected, navigate to chrome://settings/help and confirm your version is 147.0.7727.101 or later.

Chromium is the upstream for other browsers such as Microsoft Edge, Brave, and Opera, so those vendors are expected to include the same fix in their own downstream releases. Security teams should track those downstream advisories independently.

In enterprise environments, administrators can manage Chrome browser updates through Chrome Enterprise Core and choose when updates reach users by placing them on specific release channels.

Affected Systems and Versions

All versions of Google Chrome prior to 147.0.7727.101 are affected. By platform:

• Windows and macOS: All Chrome versions before 147.0.7727.101/102
• Linux: All Chrome versions before 147.0.7727.101
• Android: All Chrome versions before 147.0.7727.101

The initial Chrome 147 release (147.0.7727.55/56, April 7, 2026) is also vulnerable, because CVE-2026-6309 was not fixed until the mid-cycle patch on April 15.

Treat Chromium-based browsers (Microsoft Edge, Brave, Opera, and others) as potentially affected until they incorporate the upstream fix from Chromium issue 497846428.

Vendor Security History

Google runs an active Vulnerability Reward Program that pays external security researchers for responsibly disclosed bugs. The April 15, 2026 release notes list payouts that include a $90,000 reward for a Critical heap buffer overflow in ANGLE and a $10,000 reward for a Critical use after free in Proxy.

Google reported CVE-2026-6309 internally, which may mean the bug was found through internal fuzzing infrastructure or code review. Viz has had earlier security fixes, including CVE-2024-4671, which was also a use after free in the Visuals/Viz layer. Use-after-free vulnerabilities keep recurring in compositor subsystems, which suggests that object lifetime management in GPU compositing code is still hard to get right, even with Chrome's substantial investment in memory safety tooling.

References

• CVE-2026-6309 Detail, NVD
• Stable Channel Update for Desktop, April 15 2026
• Chromium Issue 497846428
• Chromium Viz Component README
• RenderingNG Architecture, Chrome for Developers
• Update Google Chrome, Computer
• Manage Chrome Updates, Chrome Enterprise Core
• Chrome Browser Release Channels
• Google Vulnerability Reward Program Rules