CVE-2026-6307 involves a type confusion vulnerability in Google Chrome that enables a complex Windows kernel-mode rootkit to compromise system security. The rootkit uses advanced techniques such as patching ETW, Direct Kernel Object Manipulation (DKOM), hooking the NSI driver, and manipulating the Windows Filtering Platform to evade detection and hide malicious activity. It establishes a covert control channel via registry writes monitored by a kernel callback, bypassing network-based detection mechanisms. The rootkit impersonates legitimate Microsoft services and minifilter drivers, performs anti-sandbox checks using hypervisor time-stamp counter probing, and exposes numerous kernel primitives including arbitrary physical memory access, process injection, hardware input spoofing, and reflective PE loading. The vulnerability affects Chrome versions up to and including 147.0.7727.101. Google has released a patch to address this issue.

Successful exploitation allows attackers to gain kernel-level control over the Windows system, enabling them to hide processes, network connections, and security products, execute arbitrary code with high privileges, and maintain persistent covert communication channels. This leads to full system compromise with confidentiality, integrity, and availability impacts rated high.

A patch for this vulnerability is available from Google. Users and administrators should apply the official Chrome update to versions later than 147.0.7727.101 as soon as possible to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.