Quick Look: CVE-2026-6359, a High Severity Use After Free in Google Chrome's Video Component on Windows

Introduction

A use-after-free vulnerability in Google Chrome's Video component on Windows, patched on April 15, 2026, lets an attacker who has already compromised the renderer process perform out-of-bounds memory access through a crafted HTML page. Chrome holds nearly 70 percent of the desktop browser market, so the number of Windows endpoints that may be affected makes this patch cycle worth attention from enterprise security teams, even though no in-the-wild exploitation has been confirmed.

Technical Information

CVE-2026-6359 is a use-after-free (CWE-416) vulnerability in the Video subsystem of Google Chrome. Chrome's video-handling code referenced a memory region that had already been deallocated. That leaves a dangling pointer. The pointer still exists and can be dereferenced, but the memory it points to may have been reallocated for another purpose or may hold attacker-controlled data.

CISA-ADP assessed the vulnerability with a CVSS 3.1 base score of 8.8 (HIGH), using the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The score reflects network accessibility, low attack complexity, no privilege requirements beyond user interaction, and high impact on confidentiality, integrity, and availability.

Attack Flow

Exploiting CVE-2026-6359 is a multi-stage process:

1. Renderer compromise (precondition): The attacker must first gain code execution in Chrome's renderer process. They could do this with a separate vulnerability, such as a V8 engine bug or a memory corruption flaw in another component. The renderer is the sandboxed process where Chrome parses and renders web content.

2. Triggering the use after free: With control of the renderer, the attacker delivers a specially crafted HTML page that exercises the vulnerable code path in the Video component. The code then tries to access a video-related object that has already been freed.

3. Out-of-bounds memory access: The dangling pointer dereference lets the attacker read or write memory outside the intended bounds. Depending on the state of the heap at the time, this could let the attacker leak sensitive data, corrupt adjacent memory structures, or achieve further code execution.

Because the attacker needs a prior renderer compromise, CVE-2026-6359 is not a standalone initial-access vector. It would most likely be the second stage of an exploit chain, which could let an attacker move from a compromised renderer toward a sandbox escape or other elevated access. That fits how advanced threat actors have historically attacked Chrome, by pairing a renderer bug with a sandbox escape to reach full system compromise.

Object Lifecycle and Root Cause

The fix would involve correcting object lifecycle management in the Video subsystem. The patch would either make sure references to freed video-related objects are invalidated, or stop the memory from being released while it is still in use. The Chromium bug is tracked as Chromium Issue 490251701. As with other Chromium security bugs, access to the issue is currently restricted. Google typically keeps security bug details locked down for at least 14 weeks, or until a large majority of Chrome users have received the update.

Patch Information

Google fixed CVE-2026-6359 in a Chrome Stable Channel update released on April 15, 2026. The announcement on the official Chrome Releases blog confirms these fixed versions:

The fix shipped as a point release on the Chrome 147 branch. That branch's initial release (147.0.7727.55) shipped around April 10, 2026 with its own set of security fixes. The .101 update targeted newly reported or newly resolved security issues such as CVE-2026-6359, in line with Google's usual cadence of shipping targeted security patches between major milestone releases. The update included 31 security fixes in total.

The bug is tracked as Chromium Issue 490251701, and access to it remains restricted under Google's standard security disclosure policy.

Chrome updates itself in the background, so most users will get this fix without doing anything. To confirm the patch is applied, open chrome://settings/help (or Menu, then Help, then About Google Chrome) and check that the version is 147.0.7727.101 or later. Users of other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) should watch for the matching downstream updates from those vendors.

Affected Systems and Versions

The vulnerability explicitly affects Google Chrome on Windows in versions prior to 147.0.7727.101. The CVE description names Windows as the affected platform, but Google released updates for all major platforms at the same time:

• Windows: All versions of Google Chrome prior to 147.0.7727.101
• macOS: Updated to 147.0.7727.101/.102 as part of the same release cycle
• Linux: Updated to 147.0.7727.101 as part of the same release cycle
• Android: Received the same security fixes as the desktop release

Organizations running any version of Chrome on Windows below 147.0.7727.101 should treat those endpoints as vulnerable. Chromium-based browsers that share the affected codebase (Microsoft Edge, Brave, Opera, Vivaldi) may also be affected, so watch for vendor-specific advisories.

Vendor Security History

Google has a well-established security program for Chrome, including a Vulnerability Reward Program that rewards external researchers for responsible disclosure. Even so, 2026 has been a busy year for attacks on Chrome. By April 2026, Google had already shipped emergency updates for four separate zero-day vulnerabilities confirmed as exploited in attacks:

• An iterator invalidation bug (February 2026)
• An out-of-bounds write in the Skia 2D graphics library
• An inappropriate implementation vulnerability in the V8 JavaScript engine
• A use-after-free weakness in Dawn (the WebGPU implementation)

That rate of zero-day exploitation shows that advanced threat actors are actively investing in Chrome vulnerability research. CVE-2026-6359 has not been linked to active exploitation, but given the pattern of chained exploits against Chrome's renderer and sandbox boundaries, patching it promptly is a practical necessity.

References

• CVE-2026-6359 Detail, NVD
• CVE Record: CVE-2026-6359
• Chrome Releases: Stable Channel Update for Desktop, April 15, 2026
• Chromium Issue 490251701
• Chrome for Android Update, April 15, 2026
• Update Google Chrome, Google Support
• Desktop Browser Market Share Worldwide, StatCounter
• Browser Market Share Worldwide, StatCounter
• Chrome Vulnerability Reward Program Rules
• Google fixes fourth Chrome zero day exploited in attacks in 2026, BleepingComputer
• CISA Adds Two Known Exploited Vulnerabilities to Catalog, April 14, 2026
• CISA Known Exploited Vulnerabilities Catalog