What is the CVSS score of CVE-2026-6319?

CVE-2026-6319 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-6319?

Yes, a patch is available for CVE-2026-6319. Update the affected software to the latest version immediately.

Chrome CVE-2026-6319

EUVD-2026-23080 HIGH

Use After Free (CWE-416)

2026-04-15 Chrome

GHSA-4hx4-54fm-qc8q

Use After Free Memory Corruption Google Denial Of Service RCE Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 10:23 vuln.today

CVSS changed

Apr 16, 2026 - 10:22 NVD

7.5 (HIGH)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23080

Analysis Generated

Apr 15, 2026 - 19:45 vuln.today

CVE Published

Apr 15, 2026 - 19:04 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Android versions prior to 147.0.7727.101 is possible through a use-after-free vulnerability in the Payments feature. Attackers who successfully convince users to perform specific UI interactions on a malicious webpage can achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability requires high attack complexity and user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), indicating social engineering is necessary. Google has released Chrome 147.0.7727.101 to address this issue. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code has been identified at time of analysis.

Technical ContextAI

This vulnerability is a use-after-free memory corruption issue (CWE-416) affecting the Payments component of Google Chrome on Android. Use-after-free vulnerabilities occur when code continues to use a memory pointer after the memory has been freed, leading to unpredictable behavior including potential arbitrary code execution. The Payments feature in Chrome handles sensitive financial transaction interfaces, making it a high-value target. The CPE identifier cpe:2.3:a:google:chrome indicates this affects Google Chrome application versions prior to 147.0.7727.101 specifically on the Android platform. The Chromium issue tracker reference (499018889) suggests this was identified through Google's internal security review process. Use-after-free bugs are particularly dangerous in browser contexts because they can be triggered remotely through specially crafted web content and can bypass modern memory protection mechanisms if exploitation conditions are met.

RemediationAI

Update Google Chrome on Android to version 147.0.7727.101 or later immediately. The patch is available through the Google Play Store as part of Chrome's standard update mechanism. For enterprise Android deployments, push the updated Chrome version through mobile device management (MDM) solutions such as Google Workspace, Microsoft Intune, or VMware Workspace ONE. Users can manually update by opening the Play Store, searching for Chrome, and selecting Update, or by enabling automatic app updates in Play Store settings. Official vendor advisory and patch details are available at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html. If immediate patching is not feasible, interim compensating controls include disabling Chrome's Payments autofill feature through chrome://settings/payments (Settings > Payment methods > toggle off 'Save and fill payment methods'), though this significantly degrades user experience for e-commerce workflows and does not eliminate risk entirely since the vulnerable code may still be reachable through crafted pages. Consider restricting user access to untrusted websites through DNS filtering or mobile threat defense solutions until patching is complete. The Chrome Sync feature should remain enabled to ensure rapid update deployment across user devices.