High

Use-after-free in Google Chrome Proxy sandbox escape

IdentifiersCVE-2026-6297CWE-416· Use After Free

CVE-2026-6297 is a critical use-after-free vulnerability in the Proxy component of Google Chrome. According to the provided content, the flaw affects Chrome versions prior to 147.0.7727.101 on Linux and prior to 147.0.7727.101/102 on Windows and macOS. The issue is described as a stale-pointer dereference condition in Chrome’s proxy-related code path, likely within Chromium’s networking/proxy subsystem, where a proxy-related object can be freed and later reused. Successful exploitation is triggered via a crafted HTML page and can allow an attacker in a privileged network position to cross Chrome’s normal renderer isolation boundary and achieve a sandbox escape.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can potentially allow a sandbox escape from Chrome’s renderer context into a more privileged browser or network-service context. The provided content further indicates this may lead to arbitrary code execution and high-impact compromise of confidentiality, integrity, and availability, consistent with the supplied CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Because the flaw crosses a security boundary, it can undermine Chrome’s multi-process sandbox model and materially increase the attacker’s ability to execute code or further compromise the host.

Mitigation

If you can’t patch tonight, do this now.

No vendor workaround or alternative mitigation was published in the provided content. Until patching is completed, risk can only be reduced operationally by limiting exposure to attacker-controlled or untrusted networks, avoiding use of hostile Wi-Fi or upstream proxies, and reducing opportunities for users to load attacker-supplied crafted HTML content. These measures are partial only; the content indicates patching is the only confirmed mitigation.

Remediation

Patch, then assume compromise.

Update Google Chrome to a fixed version: 147.0.7727.101 on Linux, and 147.0.7727.101/102 on Windows and macOS, or later. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should also be updated once they have integrated the upstream Chromium fix from the 147 branch. The provided content states that patching is the only confirmed remediation.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cyber security newsNews

Apr 16, 2026

Critical Chrome Vulnerabilities Let Attackers Execute Arbitrary Code - Update Now!

A critical use-after-free vulnerability in Chrome's Proxy component that could enable arbitrary code execution.

cvefeed high severityNews

Apr 15, 2026

CVE-2026-6297 - Google Chrome Proxy Use-After-Free Vulnerability

A critical use-after-free vulnerability in the Proxy component of Google Chrome that could allow a sandbox escape via a crafted HTML page when exploited by an attacker in a privileged network position.

chrome releases blogNews

Apr 15, 2026

Chrome Releases: Stable Channel Update for Desktop

A critical use-after-free vulnerability in Proxy in Google Chrome.

zeropath blogNews

Apr 15, 2026

Google Chrome CVE-2026-6297: Brief Summary of a Critical Use After Free in the Proxy Component Enabling Sandbox Escape - ZeroPath Blog | ZeroPath

A critical use-after-free vulnerability in Google Chrome's Proxy component that can enable sandbox escape and potentially arbitrary code execution when a user visits a crafted HTML page while the attacker has a privileged network position.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-6297

NVD

nvd.nist.gov/vuln/detail/CVE-2026-6297

MITRE CWE · CWE-416

Use After Free

Vendor Advisory

chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html

Permissions Required

issues.chromium.org/issues/493628982