A use-after-free vulnerability exists in the XR component of Google Chrome on Android prior to version 147.0.7727.101. This vulnerability allows remote attackers to perform out-of-bounds memory reads via a crafted HTML page. The issue is tracked as CVE-2026-6358 and has a CVSS v3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is not reported to have known exploits in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Successful exploitation of this vulnerability can lead to out-of-bounds memory reads, potentially exposing sensitive information or causing application instability. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. No known active exploits have been reported, but the vulnerability could be leveraged by remote attackers through user interaction with malicious web content.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when browsing untrusted websites on affected Chrome versions. Monitor official Google Chrome release notes for updates addressing this vulnerability.