High

Type Confusion in Google Chrome Turbofan

IdentifiersCVE-2026-6307CWE-843· Access of Resource Using…

CVE-2026-6307 is a high-severity type confusion vulnerability in Google Chrome's V8 Turbofan optimizing JIT compiler. It affects Chrome versions prior to 147.0.7727.101 and can be triggered by a remote attacker through a crafted HTML page. The available supporting content indicates the flaw arises when Turbofan makes speculative type assumptions during optimization and fails to properly deoptimize when those assumptions are violated at runtime. As a result, generated machine code may operate on objects using an incorrect type layout, leading to controlled memory corruption and ultimately arbitrary code execution within the renderer process sandbox.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary code execution inside Chrome's renderer sandbox. Although execution is constrained by the sandbox, the compromise can still expose sensitive browser-context data such as cookies, session tokens, and rendered page content, and may provide a foothold for chaining with a separate sandbox escape vulnerability to achieve broader browser-process or full system compromise.

Mitigation

If you can’t patch tonight, do this now.

Apply vendor patches as soon as available and verify deployed browser versions rather than relying solely on staged auto-update rollout. Until patching is complete, reduce exposure to untrusted web content, especially links, redirects, malvertising, phishing pages, and compromised sites that could deliver crafted HTML. Enterprise defenders should prioritize rapid browser update compliance across fleets because exploitation requires only webpage rendering.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome to a fixed version. The supporting content states Google addressed the issue in Chrome 147.0.7727.101 for Linux and Android, and in 147.0.7727.101/102 for Windows and macOS. Any Chrome version prior to 147.0.7727.101 should be considered vulnerable. Downstream Chromium-based browsers such as Microsoft Edge, Brave, and Opera also require their respective vendor updates incorporating the upstream Chromium fix.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cvefeed high severityNews

Apr 15, 2026

CVE-2026-6307 - Google Chrome Turbofan Type Confusion Arbitrary Code Execution

A high-severity type confusion vulnerability in Turbofan in Google Chrome that allows remote code execution inside the sandbox via a crafted HTML page.

chrome releases blogNews

Apr 15, 2026

Chrome Releases: Stable Channel Update for Desktop

A high-severity type confusion vulnerability in Turbofan in Google Chrome.

zeropath blogNews

Apr 15, 2026

Quick Look: CVE-2026-6309, Use After Free in Google Chrome Viz Enables Sandbox Escape - ZeroPath Blog | ZeroPath

A high-severity type confusion vulnerability in Chrome's Turbofan component, mentioned as a possible renderer-compromise precursor in an exploit chain.

zeropath blogNews

Apr 15, 2026

Brief Summary: Google Chrome CVE-2026-6307 Turbofan Type Confusion Enabling Sandboxed Code Execution - ZeroPath Blog | ZeroPath

A Chrome V8 Turbofan JIT type confusion vulnerability that can lead to arbitrary code execution within Chrome's renderer sandbox via a malicious webpage.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-6307

NVD

nvd.nist.gov/vuln/detail/CVE-2026-6307

MITRE CWE · CWE-843

Access of Resource Using Incompatible Type…

Vendor Advisory

chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html

Permissions Required

issues.chromium.org/issues/497404188