CVE-2026-16804: Use-After-Free in Chromium Input—Immediate Patch Required for Edge and Chrome

THREAT BRIEF

CVE-2026-16804 is a newly disclosed use-after-free vulnerability in the Chromium project’s Input component, impacting all Chromium-based browsers including Google Chrome and Microsoft Edge. This flaw allows attackers to exploit freed memory references, potentially leading to remote code execution if a user visits a malicious webpage. Microsoft acknowledges the vulnerability in Edge, which ingests upstream Chromium patches. For further technical details and patch information, refer to the Google Chrome Releases blog and the Microsoft Security Response Center advisory.

SCOPE & IMPACT

• Products Affected: Google Chrome, Microsoft Edge (Chromium-based), other Chromium-derivative browsers.
• Versions: All Chrome and Edge versions prior to their respective June 2026 security releases (exact build numbers listed below).
• Configurations: No mitigation in default settings; exploit is possible on any OS where these browsers run.
• Users Exposed: Any user browsing untrusted content, notably enterprise environments with high browsing volume.
• Impact: Potential remote code execution, privilege escalation, and sandbox escape.

WHAT CHANGED IN THIS RELEASE / ADVISORY

• CVE-2026-16804 addressed upstream in Chromium and ingested by Microsoft Edge.
• Patched versions:
  • Google Chrome: 127.0.6572.81 and later
  • Microsoft Edge (Chromium): 127.0.6572.81 and later
• Behavioural difference: Pre-patch, freed Input objects could be referenced after deletion, creating a memory safety hazard. Post-patch, Chromium ensures Input objects are correctly invalidated and references are not reused.

HOW IT WORKS

The use-after-free vulnerability arises when the Chromium Input component incorrectly manages object lifetimes during certain input event handling scenarios. If a webpage triggers a sequence of input events that cause an Input object to be deleted but its reference remains accessible, subsequent use can manipulate the freed memory. An attacker exploiting this flaw could craft a webpage to trigger controlled memory corruption, bypassing browser sandboxing and potentially executing arbitrary code.

This class of bug is high-risk due to the prevalence of web-based attacks, ease of exploitation, and the potential for chained vulnerabilities leading to full system compromise.

DETECTION

Security teams should immediately audit browser installations to confirm patch status. The following snippets enumerate browser versions for Chrome and Edge on Windows, Linux, and macOS.

Windows: Audit Microsoft Edge Version

try {
  $edgePath = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe").'(default)'
  if ($edgePath -and (Test-Path $edgePath)) {
    $edgeVersion = (Get-Item $edgePath).VersionInfo.FileVersion
    Write-Output "Microsoft Edge Version: $edgeVersion"
  } else {
    Write-Output "Edge not found in registry."
  }
} catch {
  Write-Output "Error detecting Edge: $_"
}

Windows: Audit Google Chrome Version

try {
  $chromePath = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe").'(default)'
  if ($chromePath -and (Test-Path $chromePath)) {
    $chromeVersion = (Get-Item $chromePath).VersionInfo.FileVersion
    Write-Output "Google Chrome Version: $chromeVersion"
  } else {
    Write-Output "Chrome not found in registry."
  }
} catch {
  Write-Output "Error detecting Chrome: $_"
}

Linux/macOS: Audit Chromium-Based Browser Versions

for browser in google-chrome msedge chromium-browser; do
  if command -v $browser >/dev/null; then
    ver=$($browser --version 2>/dev/null)
    echo "$browser: $ver"
  else
    echo "$browser not installed"
  fi
done

Check reported versions; anything older than 127.0.6572.81 is vulnerable.

REMEDIATION

• Patch: Update Google Chrome and Microsoft Edge to version 127.0.6572.81 or later on all endpoints.
• Update Mechanism:
  • On Windows/macOS: Use built-in browser auto-update or enterprise management tools (Intune, GPO, JAMF).
  • On Linux: Update via package manager (e.g., sudo apt update && sudo apt upgrade google-chrome-stable).
• Compensating Controls:
  • Block access to untrusted web content until patching is complete.
  • Leverage browser sandboxing and application whitelisting as interim measures.
• Scripted Patch Audit: Use detection scripts above in dry-run/report mode. Do not attempt forced upgrades without user testing.
• Irreversible Actions: None; browser updates can be rolled back, but this is not recommended.

MITIGATION PRIORITY

Immediate—Patch all affected browsers today. This is a memory safety bug with known exploitation patterns and high risk of remote code execution. Delay increases exposure to potential zero-day attacks.

WHAT’S COMING

• Chromium and Edge will continue rapid patch cycles; next scheduled security update is July 2026.
• Expect improved memory safety features (e.g., Rust integration, enhanced sandboxing) in future releases as vendors respond to ongoing UAF threats.
• Microsoft and Google routinely backport critical fixes—verify that managed endpoints receive security updates regardless of OS version.

TREND CHECK

Use-after-free vulnerabilities in Chromium have remained a persistent threat, but vendor response has accelerated. Both Google and Microsoft have shown improved patch velocity and transparency, with most UAF bugs addressed within days of disclosure. However, active exploitation campaigns targeting browser memory safety bugs are increasing as threat actors focus on client-side attack surfaces. Security teams must treat browser patching as core hygiene and monitor for signs of exploitation (e.g., suspicious browser crashes, anomalous web activity).

In summary, CVE-2026-16804 exemplifies the ongoing challenges of memory management in complex software. Rapid detection, patching, and policy enforcement will minimize enterprise risk.