Description
Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-04-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A use‑after‑free vulnerability exists in Chrome’s Payments component on Android for versions older than 147.0.7727.101. It allows a remote attacker who tricks a user into performing specific UI gestures to cause arbitrary code execution from a crafted HTML page. The weakness is identified as a memory safety flaw (CWE‑416) and a use of uninitialized data flaw (CWE‑825).

Affected Systems

Google Chrome for Android versions prior to 147.0.7727.101 are affected. Users of these older versions should be aware that any site that can load a malicious Payment‑related page could trigger the exploit.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.5, indicating high severity, and is not yet listed in CISA’s KEV catalog. No EPSS score is available, but the requirement for user interaction and the need to host a crafted page reduces the likelihood of widespread exploitation. The remote attacker can execute code only on the victim’s device, providing full control over the affected Chrome instance.

Generated by OpenCVE AI on April 17, 2026 at 05:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 147.0.7727.101 or later via the official update channel.
  • If an immediate upgrade is not possible, disable or block the Payments API in Chrome settings or use a browser profile that excludes the Payments feature.
  • Until a patch is applied, avoid interacting with Payment prompts from unfamiliar or untrusted sites and consider using an alternative browser for sensitive transactions.

Generated by OpenCVE AI on April 17, 2026 at 05:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6214-1 chromium security update
History

Thu, 16 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Thu, 16 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Payments
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 15 Apr 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 15 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Description Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-16T09:58:55.486Z

Reserved: 2026-04-14T18:12:28.557Z

Link: CVE-2026-6319

cve-icon Vulnrichment

Updated: 2026-04-16T09:58:50.481Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-04-15T20:16:42.203

Modified: 2026-04-17T15:08:01.337

Link: CVE-2026-6319

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-15T00:00:00Z

Links: CVE-2026-6319 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T06:00:09Z

Weaknesses