VulnSocial

CVE-2026-6300PoC(apple / chrome)

CRITICALCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (7 mentions)

Immediate actions

  • Patch apple chrome systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

apple CVEsBack to dashboard
8.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-416

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome
  • linux_kernel
  • macos
  • windows

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 13 mentions across 5 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 8 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 7 signals
  • Disclosure: 4 classified signals
  • Peaked at 7 mentions on most recent observed day (2026-08-19)
  • 13 total mentions across 5 days

Affected systems

Vendors
applegooglelinuxmicrosoft
Products
chromelinux_kernelmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline13 mentions / 5d
02457Mentions · 2026-04-15: 1Mentions · 2026-04-16: 3Mentions · 2026-04-17: 1Mentions · 2026-07-08: 1Mentions · 2026-08-19: 7PoC Mentioned / Linked · 2026-07-08: 1PoC Mentioned / Linked · 2026-08-19: 7Exploit Tool / Code · 2026-07-08: 1Exploit Tool / Code · 2026-08-19: 1Active Exploitation · 2026-08-19: 1Patch / Workaround · 2026-04-17: 1Technical Details · 2026-04-15: 1Technical Details · 2026-04-16: 3Technical Details · 2026-04-17: 1Technical Details · 2026-07-08: 1Technical Details · 2026-08-19: 104-1504-1604-1707-0808-19
Signal classification5 categories
PoC
646.2%
Disclosure
430.8%
Patch
17.7%
Exploit
17.7%
Active Exploitation
17.7%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-04-151
Disclosure1
2026-04-163
Disclosure3
2026-04-171
Patch1
2026-07-081
Exploit1
2026-08-197
Active Exploitation1PoC6
Full discourse13 posts
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-6300 PT ID: PT-2026-33138 Vendor: Google Product: Chrome Description: Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-33138 • https://github.com/notthemystery/CVE-2026-6300-PoC #dbugs_vuln

    Post summary

    PoC and exploit code for CVE‑2026‑6300 have been released on GitHub, yet no evidence of active exploitation or vendor patch is reported.

    0301462.2K
    3.4K followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    Source: X search for PoC exploit 2026 Posted: 2026-07-08T14:05:50.000Z Likes: 12 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-6300

    Post summary

    The post confirms that a PoC/exploit exists for CVE-2026-6300, but lacks further technical or operational details.

    1000054
    324 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    CVE-2026-6300: A PoC/exploit has been discovered for vulnerability CVE-2026-6300 PT ID: PT-2026-33138 Vendor: Google Product: Chrome Description: Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a…

    Post summary

    A proof‑of‑concept exploit for CVE‑2026‑6300, a use‑after‑free flaw in Google Chrome’s CSS parsing before version 147.0.7727.101, has been discovered, but no active exploitation or patch details are mentioned.

    10000113
    324 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    17:05 UTC: First exploit attempt in the wild. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-6300

    Post summary

    A PoC/exploit for CVE-2026-6300 was discovered, marking the first reported wild exploit attempt.

    1000053
    324 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    14:19 UTC: Thread live on @lyrie_ai. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-6300

    Post summary

    The tweet announces that a proof‑of‑concept/exploit has been discovered for CVE‑2026‑6300, without providing additional technical or patch details.

    1000047
    324 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    14:16 UTC: GPT-5 enrichment complete. 73 words. 1 citations. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-6300

    Post summary

    The tweet announces that a PoC/exploit exists for CVE‑2026‑6300, but provides no code, real‑world exploitation claims, patches, or technical details.

    1000019
    325 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    14:08 UTC: Lyrie Sentinel flagged it. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-6300

    Post summary

    A proof of concept/exploit has been publicly discovered for CVE-2026-6300, though no detailed exploit code or evidence of active exploitation is included.

    1000036
    324 followersView on X
  • Lyrie.ai@lyrie_ai
    PoC

    14:05 UTC: CVE-2026-6300 disclosed. A PoC/exploit has been discovered for vulnerability CVE-2026-6300 PT ID: PT-2026-33138 Vendor: Google Product: Chrome

    Post summary

    A PoC for CVE-2026-6300 has been discovered and disclosed, but no exploitation details, active attacks, or patch information are provided.

    1000064
    324 followersView on X
  • WindowsForum@windowsforum
    Patch

    🪟 CVE-2026-6300: Chrome’s CSS use-after-free shows Windows’ browser stack is still one crafted page away from drama. Update Edge, folks—memory safety shouldn’t be a subscription. https://windowsforum.com/threads/cve-2026-6300-chrome-css-use-after-free-update-now-for-edge-and-windows.413842/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #EdgeChromium #MemorySafety #ChromeSecurity #Cve20266300 https://t.co/xiVst7hvVQ

    Post summary

    The tweet alerts users to a use‑after‑free bug in Chrome’s CSS (CVE‑2026‑6300) and urges an update to Edge, focusing on patching rather than showing an exploit.

    0000058
    1.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-6300 Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s… https://www.cve.org/CVERecord?id=CVE-2026-6300 ----- Traducción: CVE-2026-6300 uso… http://infoflow.cloud`

    Post summary

    The message announces CVE-2026-6300, a use‑after‑free flaw in Chrome's CSS handling that permits remote code execution inside a sandbox via crafted HTML. No PoC, exploit code, or active exploitation is referenced.

    0000028
    71 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-6300 Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s… https://www.cve.org/CVERecord?id=CVE-2026-6300

    Post summary

    The post discloses CVE-2026-6300, a use‑after‑free in Chrome’s CSS that can lead to remote code execution via crafted HTML, but includes no PoC, exploit tools, or evidence of active exploitation.

    00000257
    57.2K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-6300 Use After Free in CSS in Google Chrome Prior to 147.0.7727.101 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6300 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The text announces CVE-2026-6300, a use-after-free vulnerability in CSS for Google Chrome versions older than 147.0.7727.101, and links to additional details for further information.

    0000080
    4.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-6300 Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code insi… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6300 #Google #CyberSecurity #InfoSec

    Post summary

    The post announces CVE-2026-6300, detailing a use-after-free in Chrome’s CSS engine that permits remote code execution, with a CVSS score of 8.8, and provides a link to a comprehensive analysis.

    000001
    145 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
OSapplemacos---
Appgooglechrome---
OSlinuxlinux_kernel---
OSmicrosoftwindows---

Explore more

Back to dashboardapple CVEsgoogle CVEslinux CVEschrome vulnerabilities