Loading story…
Google disclosed two high-severity use-after-free vulnerabilities in Chrome, CVE-2026-6302 and CVE-2026-6304, affecting versions prior to 147.0.7727.101. The flaws reside in the browser's Video and Graphite components and can be triggered with a crafted HTML page. CVE-2026-6302 could allow a remote attacker to execute arbitrary code inside the sandbox, while CVE-2026-6304 could let an attacker who has already compromised the renderer process potentially escape Chrome's sandbox.
Both issues are classified as CWE-416 use-after-free bugs and were rated High severity by Chromium. The published CVSS v3.1 vectors indicate significant potential impact to confidentiality, integrity, and availability, with CVE-2026-6302 scored as AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and CVE-2026-6304 as AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Organizations running Chrome should prioritize upgrading to 147.0.7727.101 or later to mitigate the risk from malicious web content targeting these memory-safety flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Later on April 15, 2026, the CVE records for both Chrome vulnerabilities were updated with CVSS v3.1 vectors. The updates quantified the potential confidentiality, integrity, and availability impact of the two high-severity flaws.
Google disclosed CVE-2026-6304 on April 15, 2026 as a high-severity use-after-free vulnerability in Chrome's Graphite component affecting versions prior to 147.0.7727.101. The issue could allow an attacker, after compromising the renderer process, to potentially escape Chrome's sandbox using a crafted HTML page.
Google disclosed CVE-2026-6302 on April 15, 2026 as a high-severity use-after-free vulnerability in Chrome's Video component affecting versions prior to 147.0.7727.101. The flaw could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google disclosed two high-severity Chrome vulnerabilities in WebRTC, tracked as **`CVE-2026-7336`** and **`CVE-2026-7341`**, that affect versions prior to **`147.0.7727.138`**. Both bugs are classified as **CWE-416 use-after-free** issues and can be triggered when a user loads a crafted HTML page, allowing a remote attacker to achieve arbitrary code execution **inside the browser sandbox**. The CVE records link the flaws to Chrome release notes and Chromium issue tracker entries, and both were published by Google's Chrome security team before receiving updates with CVSS details. **`CVE-2026-7336`** was assigned a high-severity **CVSS v3.1** rating reflecting impacts to confidentiality, integrity, and availability, while **`CVE-2026-7341`** was later updated to clarify that exploitation requires **user interaction**, correcting an earlier scoring entry while preserving its overall high-impact assessment.
Jun 29, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 2, 2026