Quick Look: CVE-2026-6315, Use After Free in Google Chrome Permissions on Android

Introduction

A use-after-free vulnerability in Google Chrome's Permissions component on Android gives remote attackers a path to arbitrary code execution. The attacker needs only one thing from the victim: a visit to a malicious page, followed by certain UI interactions. Chrome holds nearly 67 percent of the global browser market, and Android holds a similar share of mobile operating systems, so the potential exposure from CVE-2026-6315 spans billions of devices worldwide.

Technical Information

CVE-2026-6315 is classified under CWE-416 (Use After Free). This class of memory corruption occurs when an application references a pointer after the memory it points to has been deallocated. Here, the vulnerable code sits in Chrome's Permissions component, which manages permission prompts and state for features like geolocation, camera, microphone, and notifications.

When a use-after-free condition is triggered in a browser, attacker-controlled data can reclaim the freed memory region through heap manipulation techniques such as heap spraying or precise allocation timing. If the application then dereferences the stale pointer, it operates on attacker-controlled memory, which can redirect execution flow and achieve arbitrary code execution.

Attack Flow

Exploitation of CVE-2026-6315 proceeds in five stages:

1. The attacker hosts a specially crafted HTML page designed to trigger the memory corruption in Chrome's Permissions subsystem.
2. The victim opens the malicious page in Chrome on Android. Loading the page alone does not trigger the vulnerability.
3. The victim performs specific UI gestures while interacting with the page. The exact nature of these gestures is not publicly documented, and the Chromium issue tracker entry (issue 499247910) remains restricted.
4. The UI gestures trigger a sequence in the Permissions component where a memory object is freed but a reference to it is retained and later accessed.
5. The attacker uses this dangling pointer access to execute arbitrary code in the context of the Chrome browser process.

CVSS Breakdown

The CVSS 3.1 base score of 8.8 reflects the following vector: Network attack vector, Low attack complexity, No privileges required, User Interaction required. Impact is High for Confidentiality, Integrity, and Availability, which is consistent with arbitrary code execution.

The Chromium bug tracker entry is still restricted, so two details are not public: which object in the Permissions subsystem is freed prematurely, and the code-level diff of the fix. This is standard Chromium practice. As the release notes state, "access to bug details and links may be kept restricted until a majority of users are updated with a fix." Security teams should assume this vulnerability is highly exploitable, given the High severity rating it received from both the Chromium security team and CISA ADP.

Patch Information

Google fixed CVE-2026-6315 in a Chrome Stable Channel update released on April 15, 2026. The fix shipped in these browser versions:

Google's own security team found the vulnerability and reported it internally on April 3, 2026. Because it was an internal finding, no external bug bounty was awarded (marked [N/A] in the release notes). The entry in the Chrome Releases blog post reads:

[N/A][499247910] High CVE-2026-6315: Use after free in Permissions. Reported by Google on 2026-04-03

The High severity tag means the Chromium security team judged this a serious issue where exploitation could lead to code execution, though typically within the browser sandbox. CISA ADP agreed and assigned a CVSS 3.1 base score of 8.8.

This fix was one of 31 security fixes in the same stable channel update. They range from critical heap buffer overflows in ANGLE and Skia to high-severity use-after-free bugs across multiple components (Video, CSS, Dawn, Codecs, and more). The update moved the stable channel from the initial Chrome 147.0.7727.55/56 release, which shipped approximately a week earlier on April 7 with 60 security fixes, to the 147.0.7727.101/102 patch level.

On Android, Google says the update will reach devices through Google Play over several days. Organizations managing mobile fleets should push the update through Mobile Device Management (MDM) solutions instead of waiting for the automatic rollout. End users can update manually:

1. Open the Google Play Store.
2. Tap the profile icon.
3. Tap "Manage apps and device."
4. Install the pending Chrome update.

Any version of Chrome prior to 147.0.7727.101, on any platform, remains vulnerable. Users on those versions should update immediately.

Affected Systems and Versions

The vulnerability affects the following configurations:

The NVD description names Android as the affected platform. Even so, the patch was applied on all desktop platforms too, and the vulnerability exists in the shared Chromium Permissions component. The main exploitation scenario in the advisory targets Android.

Vendor Security History

Google maintains a strong security posture for Chrome, but the browser's complexity and large attack surface mean memory corruption vulnerabilities keep appearing. Examples from 2026 alone show the pattern:

In 2025, Google fixed eight zero-day vulnerabilities that were exploited in attacks. The company runs a formal Vulnerability Reward Program and aims to deploy patches for critical vulnerabilities to all Chrome users in under 30 days. CVE-2026-6315 was reported internally on April 3 and patched on April 15, a turnaround of 12 days and well within that target.

References

• CVE-2026-6315 Detail, NVD
• CVE Record: CVE-2026-6315
• Chrome Releases: Stable Channel Update for Desktop, April 15, 2026
• Chrome for Android Update, April 15, 2026
• Chromium Issue 499247910
• CISA Known Exploited Vulnerabilities Catalog
• Browser Market Share Worldwide, Statcounter
• Mobile Operating System Market Share Worldwide, Statcounter
• Update Google Chrome on Android
• Chromium Severity Guidelines for Security Issues
• Chrome Vulnerability Reward Program Rules
• Google fixes fourth Chrome zero day exploited in attacks in 2026, BleepingComputer
• Chrome Vulnerability CVE-2026-5281 Exploited in the Wild, eSecurity Planet