Introduction
A use-after-free vulnerability in Google Chrome's FileSystem component gives remote attackers a path to object corruption and potential code execution through nothing more than a crafted web page. Chrome is installed on roughly 3.62 billion devices and holds over 75% of the desktop browser market, so the exposure from CVE-2026-6360 is significant. Google released a patch on April 15, 2026, and security teams should apply it promptly.
Technical Information
The root cause of CVE-2026-6360 is a use-after-free condition (CWE-416) in Chrome's FileSystem component, the internal browser subsystem that handles the File System Access API and legacy file system operations. A use-after-free occurs when a program keeps using a pointer after the memory it points to has been freed. If an attacker can reallocate that freed memory with controlled data, they can corrupt valid objects or manipulate heap metadata to hijack execution flow.
Use-after-free bugs in the FileSystem component are particularly concerning because this subsystem manages object lifetimes tied to asynchronous I/O callbacks. If an object is freed while a pending callback still holds a dangling reference, an attacker can spray the heap with controlled data and hijack execution when the stale pointer is dereferenced. The NVD description confirms the flaw allowed "a remote attacker to potentially exploit object corruption via a crafted HTML page."
CVSS Breakdown
CISA ADP assigned a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The table below breaks down each metric.
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network (N) | Exploitable remotely over the internet |
| Attack Complexity | Low (L) | No advanced system conditions required |
| Privileges Required | None (N) | Attacker needs no prior authentication |
| User Interaction | Required (R) | Victim must visit a crafted HTML page |
| Confidentiality | High (H) | Full compromise possible |
| Integrity | High (H) | Full compromise possible |
| Availability | High (H) | Full compromise possible |
Attack Flow
Exploitation would proceed as follows:
- An attacker crafts a malicious HTML page designed to trigger the use-after-free condition in Chrome's FileSystem component.
- The attacker lures the victim to the page through social engineering, a malicious advertisement, or a compromised legitimate website.
- When the page loads, it exercises the FileSystem API in a way that causes an object to be freed while a reference to it is still held.
- The page then sprays the heap to place controlled data in the freed memory region.
- When Chrome later dereferences the stale pointer, it treats the attacker's data as a valid object, which corrupts the object.
- Depending on the attacker's payload, this can lead to arbitrary code execution within the Chrome renderer sandbox, a denial-of-service condition, or further exploitation to escape the sandbox.
The exploit needs only a page visit, with no elevated privileges or installed extensions, so it is a meaningful drive-by download risk for enterprise environments. The underlying Chromium bug tracker issue (497880137) is still access restricted, which is standard Chrome practice to keep exploitation details from being disclosed early.
Patch Information
Google fixed CVE-2026-6360 in a Chrome Stable channel update released on April 15, 2026, which moved desktop versions to 147.0.7727.101/102 on Windows and macOS and 147.0.7727.101 on Linux. It was a point release on top of the initial Chrome 147 baseline (147.0.7727.55/56, released April 7), so the fix was backported into the existing stable branch instead of waiting for the next major milestone.
The Chrome Releases blog post lists the fix in its security table as:
[TBD][497880137] High CVE-2026-6360: Use after free in FileSystem. Reported by asjidkalam on 2026-03-31
The "TBD" bounty indicates that Google had acknowledged the external report but had not finalized the reward when the post was published. The same stable update shipped 31 security fixes, including several other issues rated Critical or High in ANGLE, Skia, V8/Turbofan, PDFium, Dawn, and other components.
| Operating System | Vulnerable Versions | Fixed Version |
|---|---|---|
| Linux | Prior to 147.0.7727.101 | 147.0.7727.101 or later |
| macOS | Prior to 147.0.7727.101/102 | 147.0.7727.101/102 or later |
| Windows | Prior to 147.0.7727.101/102 | 147.0.7727.101/102 or later |
Chrome's built-in auto-update mechanism delivers this update, but the patched binary only takes effect after a browser restart. Network administrators should check that auto-update is working across their fleet, or push the update manually through enterprise management tools. The Canadian Centre for Cyber Security and the Hong Kong CERT both strongly encourage users and administrators to apply these updates immediately.
Because the Chromium bug tracker issue is still access restricted, no source-level diff or commit detail is public yet. The Chromium source log comparing 147.0.7727.56..147.0.7727.102 shows the full changelog between the previous baseline and the patched version, but the publicly visible data does not yet identify which commit is the FileSystem fix.
Affected Systems and Versions
The vulnerability affects every Google Chrome desktop installation on Windows, macOS, and Linux that runs a version before the patched release:
- Windows: All versions prior to 147.0.7727.101/102
- macOS: All versions prior to 147.0.7727.101/102
- Linux: All versions prior to 147.0.7727.101
That includes the initial Chrome 147 baseline release (147.0.7727.55/56, released April 7, 2026) and every earlier version. Any Chromium-based browser that incorporates the affected FileSystem component code may also be vulnerable. Check the vendor's own advisory to confirm.
Vendor Security History
Google's security program for Chrome includes a Vulnerability Reward Program that pays monetary awards for responsibly disclosed bugs. The "TBD" bounty status for CVE-2026-6360 indicates the reward was still being evaluated when the patch shipped.
To counter the exploitation of zero-day vulnerabilities, Google moved Chrome to a biweekly release cadence, which cut its average patch gap to approximately 15 days. CVE-2026-6360 moved just as quickly. The bug was reported on March 31, 2026, and the patch shipped on April 15, 2026.
Use-after-free bugs come up again and again in Chrome security issues. Earlier in April 2026, Google patched CVE-2026-5281, another use-after-free flaw that was confirmed to have an active exploit in the wild. That flaw was in a different component but carries the same CWE-416 classification, part of a persistent pattern of memory-safety problems across Chrome's codebase. Since attackers have already shown interest in this vulnerability class, organizations should watch the CISA Known Exploited Vulnerabilities catalog for any change in the status of CVE-2026-6360.
References
- CVE-2026-6360 Detail, NVD
- Chrome Releases: Stable Channel Update for Desktop (April 15, 2026)
- Chromium Issue 497880137
- Google Chrome Security Advisory AV26-358, Canadian Centre for Cyber Security
- Google Chrome Multiple Vulnerabilities, Hong Kong CERT
- CWE-416: Use After Free
- Chrome Vulnerability Reward Program Rules
- An Update on Chrome Security Updates, Google Security Blog
- Google Fixes Chrome Zero Day CVE-2026-5281, Help Net Security
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (April 14, 2026)
