Introduction
A use-after-free vulnerability in Google Chrome's Cast component gives remote attackers a path to arbitrary code execution, and all it takes is a visit to a malicious webpage. Chrome holds between 66.7 and 75.23 percent of the desktop browser market, so CVE-2026-6317, with its CVSS 8.8 score, is a significant exposure for virtually every organization.
Technical Information
CVE-2026-6317 is classified under CWE-416 (Use After Free) and sits in Chrome's Cast component. Cast handles Chrome's media casting, including Chromecast integration, media session management, and device communication. The bug occurs because a memory pointer tied to a Cast-related object is accessed after the underlying memory has been freed. That dangling pointer opens a window in which an attacker can reclaim the freed memory with controlled data and redirect execution flow.
CVSS Breakdown
CISA ADP assigned a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The table below shows what each metric means in practice.
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network | Exploitable remotely via a crafted webpage |
| Attack Complexity | Low | No race conditions or special configurations required |
| Privileges Required | None | No authentication needed |
| User Interaction | Required | Victim must visit the malicious page |
| Impact (C/I/A) | High/High/High | Full compromise of the browser process |
Exploitation Flow
Based on public information, exploitation would proceed like this:
- The attacker crafts an HTML page that interacts with Chrome's Cast subsystem in a way that triggers the memory management flaw.
- The attacker lures the victim to the page through phishing, a compromised website, or malicious advertising.
- The page causes a Cast-related object to be freed while a stale reference to it persists in the browser's memory.
- The attacker's payload reclaims the freed memory region and fills it with controlled data structures.
- When Chrome dereferences the dangling pointer, execution is redirected to attacker-controlled code, and the attacker gains arbitrary code execution within the browser process.
No public proof of concept or detailed exploit primitives have been published. The Chromium bug tracker entry (issues.chromium.org/issues/500091052) is still access restricted, which is standard practice. Google typically keeps security bug details locked for about 14 weeks or until most users have updated. The fix likely improves lifetime management and pointer validation in Cast's session or device objects, but the exact code changes cannot be independently verified from public sources yet.
Patch Information
Google fixed CVE-2026-6317 in a Stable Channel Update for Desktop published on April 15, 2026. It was the second stable channel security refresh for Chrome 147. The initial 147.0.7727.55/56 release landed on April 7, 2026 and fixed 60 other vulnerabilities. This later update covers additional issues, CVE-2026-6317 among them.
The fix ships in these versions:
| Platform | Fixed Version |
|---|---|
| Windows | 147.0.7727.101 or 147.0.7727.102 |
| macOS | 147.0.7727.101 or 147.0.7727.102 |
| Linux | 147.0.7727.101 |
| Android | 147.0.7727.101 |
Chrome's built-in update mechanism delivers the update automatically. You can verify it manually at chrome://settings/help, or trigger the update by opening Chrome and selecting Help, then About Google Chrome. The browser must relaunch to finish the installation.
Because Chrome's Cast component is part of the core Chromium engine, the vulnerability also affects other Chromium-based browsers (Microsoft Edge, Opera, Brave, Vivaldi, and others). Organizations running any of them should watch for those vendors to integrate the upstream patch.
Enterprise administrators should use mobile device management or endpoint management tools to push this update to all corporate endpoints.
Affected Systems and Versions
The vulnerability affects Google Chrome on desktop platforms in versions before the patched release:
| Operating System | Vulnerable Versions | Fixed Version |
|---|---|---|
| Windows | All versions prior to 147.0.7727.101 | 147.0.7727.101 or 147.0.7727.102 |
| macOS | All versions prior to 147.0.7727.101 | 147.0.7727.101 or 147.0.7727.102 |
| Linux | All versions prior to 147.0.7727.101 | 147.0.7727.101 |
| Android | All versions prior to 147.0.7727.101 | 147.0.7727.101 |
Other Chromium-based browsers that include the Cast component remain affected until they integrate the upstream Chromium patch.
Vendor Security History
Google runs a highly active security program through the Chromium security team, along with a Vulnerability Reward Program that pays monetary awards for responsibly disclosed flaws. Google also patches quickly, releasing Stable Channel updates frequently to fix critical and high-severity issues.
Attacks on Chrome remain active. In March and early April 2026 alone, Google confirmed active in-the-wild exploitation of several Chrome zero-day vulnerabilities, including CVE-2026-3910 and CVE-2026-5281. CVE-2026-6317 has not been reported as exploited in the wild, but threat actors have repeatedly weaponized Chrome use-after-free bugs quickly, which makes timely patching essential.
References
- CVE-2026-6317 Detail, NVD
- CVE Record: CVE-2026-6317
- Chrome Releases: Stable Channel Update for Desktop (April 15, 2026)
- Chromium Issue 500091052
- Google Chrome Multiple Vulnerabilities, HKCERT
- Update Google Chrome, Google Support
- Chromium Security
- Chrome Vulnerability Reward Program Rules
- New Chrome Zero Day CVE-2026-5281 Under Active Exploitation, The Hacker News
- Chrome 147 Patches 60 Vulnerabilities, SecurityWeek
