Brief Summary: Google Chrome XR Use After Free Vulnerability CVE-2026-6358

Introduction

A critical use-after-free vulnerability in Google Chrome's XR component on Android lets remote attackers perform out-of-bounds memory reads by getting a user to visit a crafted HTML page. Chrome holds roughly 69 to 79 percent of the global browser market, so the potential attack surface for CVE-2026-6358 is large. Organizations with unmanaged Android fleets are particularly exposed.

Technical Information

CVE-2026-6358 is classified under CWE-416 (Use After Free). The vulnerability is in the XR component of Google Chrome on Android. XR is the subsystem that handles WebXR and related immersive experience APIs in the browser.

A use-after-free condition occurs when a program keeps referencing a memory location after that memory has been deallocated. Here, a remote attacker can read the freed memory in the XR component out of bounds. The National Vulnerability Database reports a CVSS 3.1 base score of 8.8 (High), assigned by CISA ADP. The full vector string is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which breaks down as follows:

• Network accessible: No physical or local access is required.
• Low attack complexity: No special conditions or race conditions are needed.
• No privileges required: The attacker does not need an account or elevated access.
• User interaction required: The victim must navigate to the malicious page.
• Scope unchanged: The vulnerability affects only the vulnerable component.
• High impact across confidentiality, integrity, and availability

Chromium's internal severity assessment rated this vulnerability Critical.

Attack Flow

From the information published so far, exploitation proceeds as follows:

1. The attacker builds a malicious HTML page to trigger the use-after-free condition in Chrome's XR subsystem.
2. The attacker lures the victim to the page, for example through phishing, a malicious advertisement, or a compromised website.
3. When Chrome's XR component processes the crafted content, it accesses memory that has already been freed.
4. That access produces an out-of-bounds memory read, which could let the attacker leak sensitive data from the browser's memory space.
5. CVSS rates the impact High for confidentiality, integrity, and availability, so exploitation beyond a simple memory read (such as code execution) may be possible. No specific exploitation chain has been publicly documented.

The Chromium issue tracker entry (issue 497724498) is still access restricted, and nobody has published proof-of-concept code or detailed exploitation mechanics. Security teams should use version-based detection rather than network signatures to find vulnerable installations.

Affected Systems and Versions

The vulnerability affects Google Chrome on Android before version 147.0.7727.101. Google released patches across platforms at the same time, so treat the following as the minimum safe versions:

Any Chrome installation on Android older than 147.0.7727.101 is vulnerable to this CVE. Organizations should audit their managed device inventories and enforce the minimum version through MDM or enterprise browser management platforms.

Vendor Security History

Google runs a mature security program for Chrome and the wider Chromium project. The Chrome Vulnerability Reward Program rewards responsible disclosure, and Google publishes security updates regularly and openly through its Chrome Releases blog and the Google Security Blog.

Chrome is still a frequent target. In March 2026, Google issued an emergency update for two zero-day vulnerabilities that were confirmed to be under active exploitation. Recurring critical and zero-day vulnerabilities come with maintaining the world's most widely used browser, and they do not indicate a deficiency in Google's security practices. The restricted Chromium bug tracker entry for CVE-2026-6358 matches Google's standard practice of limiting vulnerability details until most users have updated.

References

• CVE-2026-6358 Detail, National Vulnerability Database
• CVE Record: CVE-2026-6358
• Chrome Releases: Stable Channel Update for Desktop, April 15 2026
• Chromium Issue Tracker: Issue 497724498
• Chrome for Android Update, April 15 2026
• HKCERT: Google Chrome Multiple Vulnerabilities
• The Hacker Wire: CVE-2026-6358
• Forbes: Google Zero Day Alert for 3.5 Billion Chrome Users
• Chrome Vulnerability Reward Program FAQ