CVE-2026-6309: Use after free in Viz
Chromium: CVE-2026-6309 Use after free in Viz
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
— MITRE
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-6309?
CVE-2026-6309 has been classified as a high-severity vulnerability due to the potential for exploitation in affected software.
How do I fix CVE-2026-6309?
To fix CVE-2026-6309, users should upgrade to Google Chrome version 147.0.7727.101 or later, or update Microsoft Edge (Chromium-based) as recommended.
Which versions of Google Chrome are affected by CVE-2026-6309?
Google Chrome versions prior to 147.0.7727.101 are affected by CVE-2026-6309.
Is Microsoft Edge affected by CVE-2026-6309?
Yes, Microsoft Edge (Chromium-based) versions prior to the latest patched versions are affected by CVE-2026-6309.
What is a use after free vulnerability in the context of CVE-2026-6309?
A use after free vulnerability like CVE-2026-6309 occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution.