Loading story…
Google Chrome disclosed two high-severity vulnerabilities in the Turbofan JavaScript optimization engine, tracked as CVE-2026-6301 and CVE-2026-6307. Both flaws are described as type confusion issues (CWE-843) affecting Chrome versions prior to 147.0.7727.101, and both can be triggered by a remote attacker using a crafted HTML page to achieve arbitrary code execution inside the browser sandbox.
The vulnerabilities were assigned the same CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network-based exploitation with no privileges required but with user interaction needed. Chromium rated both issues High severity, indicating that organizations running unpatched Chrome versions face meaningful risk from malicious web content and should prioritize upgrading to 147.0.7727.101 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Later on 2026-04-15, the CVE entries for CVE-2026-6301 and CVE-2026-6307 were updated to include CVSS v3.1 vectors of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The updates reflected high impact to confidentiality, integrity, and availability with user interaction required.
On 2026-04-15, Google disclosed two high-severity type confusion vulnerabilities in Chrome's Turbofan JavaScript compiler, tracked as CVE-2026-6301 and CVE-2026-6307. The flaws affect Chrome versions prior to 147.0.7727.101 and could allow remote attackers to execute arbitrary code inside the browser sandbox via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google disclosed two high-severity use-after-free vulnerabilities in Chrome, **CVE-2026-6302** and **CVE-2026-6304**, affecting versions prior to **`147.0.7727.101`**. The flaws reside in the browser's **Video** and **Graphite** components and can be triggered with a crafted HTML page. **CVE-2026-6302** could allow a remote attacker to execute arbitrary code inside the sandbox, while **CVE-2026-6304** could let an attacker who has already compromised the renderer process potentially escape Chrome's sandbox. Both issues are classified as **`CWE-416`** use-after-free bugs and were rated **High** severity by Chromium. The published CVSS v3.1 vectors indicate significant potential impact to confidentiality, integrity, and availability, with **CVE-2026-6302** scored as **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`** and **CVE-2026-6304** as **`AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`**. Organizations running Chrome should prioritize upgrading to **`147.0.7727.101`** or later to mitigate the risk from malicious web content targeting these memory-safety flaws.
Jun 29, 2026
Google disclosed two high-severity Chrome vulnerabilities in WebRTC, tracked as **`CVE-2026-7336`** and **`CVE-2026-7341`**, that affect versions prior to **`147.0.7727.138`**. Both bugs are classified as **CWE-416 use-after-free** issues and can be triggered when a user loads a crafted HTML page, allowing a remote attacker to achieve arbitrary code execution **inside the browser sandbox**. The CVE records link the flaws to Chrome release notes and Chromium issue tracker entries, and both were published by Google's Chrome security team before receiving updates with CVSS details. **`CVE-2026-7336`** was assigned a high-severity **CVSS v3.1** rating reflecting impacts to confidentiality, integrity, and availability, while **`CVE-2026-7341`** was later updated to clarify that exploitation requires **user interaction**, correcting an earlier scoring entry while preserving its overall high-impact assessment.
Jun 29, 2026