High

Use-after-free in Google Chrome CSS

IdentifiersCVE-2026-6300CWE-416· Use After Free

CVE-2026-6300 is a high-severity use-after-free vulnerability in the CSS component of Google Chrome’s Blink rendering engine. The provided context attributes the root cause to Blink’s LocalFrameView::PerformLayout(), where layout processing iterates over layout_subtree_root_list_ while interleaved style recalculation can mutate that live list. In the described scenario, CSS/container-query-driven recalculation can change an element to display:none during layout, destroying the associated LayoutObject. If ClearLayoutSubtreeRoot() mutates the subtree-root list during that iteration, Blink can retain and later dereference a dangling LayoutObject reference, resulting in a use-after-free condition. Google states that Chrome versions prior to 147.0.7727.101 are affected. Successful exploitation is possible via a crafted HTML page and results in arbitrary code execution within the browser’s renderer sandbox.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to achieve arbitrary code execution inside the Chrome renderer sandbox in the context of the targeted browser process. The CVSS v3.1 vector provided in the context (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates high potential impact to confidentiality, integrity, and availability within that sandboxed context. The vulnerability does not, by itself, imply direct operating-system-level compromise, but it can provide a strong foothold for follow-on exploitation and may be chained with a sandbox escape for full system compromise.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by limiting use of untrusted web content, restricting access to arbitrary websites, and applying enterprise browser controls that reduce browsing to attacker-controlled pages. Because exploitation requires delivery of crafted HTML/web content and user interaction, temporary mitigations include isolating high-risk browsing activities, using application isolation or remote browser isolation where available, and prioritizing patch deployment on systems exposed to general web browsing. These measures are compensating controls only; vendor updates are the primary mitigation.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome to version 147.0.7727.101 or later. The context states Google shipped fixes on April 15, 2026 in Chrome 147.0.7727.101/.102 for Windows and Mac and 147.0.7727.101 for Linux. The upstream fix reportedly changes Blink to iterate over a copy of layout_subtree_root_list_ rather than the live list directly, validates that each root still exists before processing it, adds a Contains() helper for membership checks, and includes a regression crashtest. Chromium-based downstream browsers should also be updated to versions that incorporate the upstream Blink fix.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

cvefeed high severityNews

Apr 15, 2026

CVE-2026-6300 - Google Chrome CSS Use-After-Free Vulnerability

A use-after-free vulnerability in the CSS component of Google Chrome that allows remote code execution inside the sandbox via a crafted HTML page.

chrome releases blogNews

Apr 15, 2026

Chrome Releases: Stable Channel Update for Desktop

A high-severity use-after-free vulnerability in CSS in Google Chrome.

zeropath blogNews

Apr 15, 2026

Google Chrome CVE-2026-6300: Use After Free in CSS Layout Pipeline - Technical Breakdown with Patch Analysis - ZeroPath Blog | ZeroPath

A high-severity use-after-free remote code execution vulnerability in Google Chrome's Blink CSS/layout engine that can be triggered by a crafted HTML page during interleaved style recalculation in layout processing.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-6300

NVD

nvd.nist.gov/vuln/detail/CVE-2026-6300

MITRE CWE · CWE-416

Use After Free

Vendor Advisory

chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html

Permissions Required

issues.chromium.org/issues/491994185