CVE-2026-6302

Google · Chrome

A use-after-free vulnerability in the Video component of Google Chrome prior to version 147 could allow remote code execution.

Executive summary

A use-after-free vulnerability in the Video component of Google Chrome may lead to remote code execution and system compromise.

Vulnerability

This use-after-free vulnerability resides in the Video processing component. A remote attacker can exploit this by serving malicious video content, causing the browser to execute arbitrary code when the video is rendered.

Business impact

The browser is a primary vector for attacks. With a CVSS score of 8.8, this vulnerability allows attackers to bypass security measures and execute code, potentially leading to widespread malware infections if not patched.

Remediation

Immediate Action: Update Google Chrome to version 147 or later.

Proactive Monitoring: Monitor for browser-related alerts in security dashboards.

Compensating Controls: Use endpoint security software to block the loading of suspicious media content from untrusted websites.

Exploitation status

Public Exploit Available: false

Analyst recommendation

Timely patching of Google Chrome is essential to maintaining endpoint security. Administrators should prioritize the update to version 147 to mitigate the risk associated with this use-after-free vulnerability.