Google Chrome CVE-2026-6363: Brief Summary of a V8 Type Confusion Leading to Out of Bounds Memory Access

Introduction

A type confusion flaw in Chrome's V8 JavaScript engine, tracked as CVE-2026-6363, lets a remote attacker trigger out-of-bounds memory access by luring a user to a crafted web page. Chrome holds somewhere between 65 and 79 percent of the global desktop browser market, so even a "Medium" severity rating from the Chromium team covers an enormous number of potentially affected endpoints. CISA ADP's independent assessment came in higher, at CVSS 8.8 (High).

Technical Information

Root Cause: CWE-843 Type Confusion in V8

CVE-2026-6363 falls under CWE-843, which describes the access of a resource using an incompatible type. In practice, V8 allocates or initializes an object under one type assumption, then later accesses the same memory region as though it were a different, incompatible type. V8 is written in C++, a language without memory safety guarantees, so this mismatch can cause the engine to read or write memory outside the intended bounds of the original buffer.

Type confusion vulnerabilities in V8 frequently originate in the optimizing compiler pipeline. V8 uses feedback-driven type specialization. As JavaScript code runs, the interpreter collects type profiles for variables and object properties. The optimizing compilers (TurboFan and Maglev) then use this feedback to emit highly specialized machine code that assumes specific object shapes, known internally as "maps."

Suppose an attacker crafts JavaScript that makes the engine lock in a speculative type assumption during compilation. If the attacker then supplies an object at runtime that violates that assumption after the optimized code path has been emitted, the compiled code will operate on memory using the wrong layout. Fields the compiled code expects at certain offsets may overlap with entirely different data, or may extend past the actual allocation boundary.

The result is out-of-bounds memory access. Depending on how the confused types differ in size and structure, an attacker may be able to:

1. Read memory contents beyond the intended object boundary (information disclosure).
2. Write attacker-controlled values into adjacent memory (memory corruption).
3. Chain these primitives to gain further control, potentially including arbitrary code execution within the renderer sandbox.

Attack Flow

The attack vector for CVE-2026-6363 is network based and requires user interaction. The CVSS 3.1 vector string is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which breaks down as follows:

1. Delivery: The attacker hosts a crafted HTML page containing JavaScript designed to trigger the type confusion condition in V8.
2. User interaction: The attacker convinces a target user to open the malicious page, for example through phishing, social engineering, or an iframe embedded on a compromised site.
3. Trigger: When Chrome's V8 engine processes the JavaScript on the page, the crafted input causes the optimizing compiler to emit code based on an incorrect type assumption. When that optimized code runs, it accesses memory using the wrong type layout.
4. Impact: The out-of-bounds memory access occurs within the Chrome renderer process. The CVSS assessment rates the impact as High for confidentiality, integrity, and availability, so the attacker can potentially read sensitive data, corrupt memory, and crash the process.

The attacker needs no elevated privileges. Attack complexity is rated Low, so there are no special conditions to meet and no race windows to win.

Severity Divergence

CISA ADP scores this bug at CVSS 8.8 (High), while Google's internal Chromium severity rating is Medium. Google's severity guidelines for Chromium consider factors like whether the bug is reachable from a sandboxed renderer process and whether a full exploit chain (including a sandbox escape) has been demonstrated. A type confusion that gives an out-of-bounds read or write within the renderer, without a demonstrated sandbox escape, would typically land in the Medium category under those guidelines. The CVSS score, by contrast, evaluates the theoretical worst-case impact of the vulnerability in isolation.

Patch Information

Google fixed CVE-2026-6363 in a Stable Channel update for Chrome Desktop released on April 15, 2026. The fix ships in Chrome 147.0.7727.101 for Linux and 147.0.7727.101/.102 for Windows and Mac.

The engineering details of the fix, such as the exact commit, changed files, and code diff, are not yet public. The associated Chromium bug tracker entry (issues.chromium.org/issues/495751197) is currently access restricted, which is standard Chromium practice for security-sensitive bugs. The Chromium project typically keeps these issues locked until a significant majority of users have had a chance to apply the update. After that, the bug and the corresponding fix commit are derestricted for public review.

Given the nature of the vulnerability, the patch almost certainly tightens type-checking logic within V8's internal pipeline, likely in the optimizing compiler (TurboFan or Maglev) or in the way feedback-driven type specializations are applied. Patches for type confusion issues in V8 typically add explicit type guards or map checks at critical points to ensure the runtime type matches what the compiled code expects.

Users need to update Chrome to version 147.0.7727.101 or later. Chrome's built-in auto-update mechanism will roll this out automatically, but administrators can speed up deployment by going to chrome://settings/help to trigger a manual update check. Enterprise administrators can use the Google Admin console to enforce updates across enrolled browsers.

Affected Systems and Versions

All versions of Google Chrome prior to 147.0.7727.101 on Linux, Windows, and Mac are affected. By platform:

• Linux: All Chrome versions prior to 147.0.7727.101
• Windows: All Chrome versions prior to 147.0.7727.101 (or 147.0.7727.102)
• Mac: All Chrome versions prior to 147.0.7727.101 (or 147.0.7727.102)

Any Chromium-based browser that incorporates the affected V8 engine version may also be vulnerable. Check the vendor's own advisory for those products.

Vendor Security History

Google maintains one of the most active vulnerability management programs in the industry. The Chrome Vulnerability Reward Program pays up to 250,000 USD for critical remote code execution bugs, which gives a large community of external researchers a reason to find and responsibly disclose issues. Type confusion is a recurring class of V8 finding. The engine's aggressive speculative optimization strategy depends on type assumptions, and that dependence creates a complex attack surface. Google has responded by investing in compiler hardening, moving to a two-week release cycle to ship fixes faster, and keeping strict access restrictions on bugs until patches reach broad deployment.

References

• CVE-2026-6363 Detail, NVD
• CVE-2026-6363, CVE.org
• Chrome Releases: Stable Channel Update for Desktop, April 15, 2026
• Chromium Bug Tracker: Issue 495751197
• CWE-843: Access of Resource Using Incompatible Type
• Chromium Severity Guidelines for Security Issues
• HKCERT: Google Chrome Multiple Vulnerabilities
• Canadian Centre for Cyber Security: Google Chrome Security Advisory AV26-358
• SecurityWeek: Google Now Offering Up to $250,000 for Chrome Vulnerabilities
• BleepingComputer: Google Chrome Shifts to Two Week Release Cycle