CVE-2026-6319

CVE-2026-6319 is a use-after-free memory vulnerability in the Payments feature of Google Chrome on Android affecting versions prior to 147.0.7727.101. This flaw allows a remote attacker to execute arbitrary code on a victim's device if they can convince the user to perform specific UI gestures on a crafted HTML page. The vulnerability has a Chromium-assigned severity rating of Medium. The vulnerability carries a CVSS score of 7.5 (High) with a network attack vector requiring moderate user interaction through specific gestures. While it requires user interaction and is not easily exploitable from a technical standpoint (high complexity), successful exploitation results in complete system compromise with high impact to confidentiality, integrity, and availability. The relatively low EPSS score of 0.000460 indicates this vulnerability poses minimal real-world exploitation risk currently. There is no evidence of active exploitation at this time, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and has an inactive status on security tracking lists. The FAUCET Risk Score of 48.0/100 and low EPSS percentile suggest minimal community attention and low likelihood of publicly available exploit code. Organizations should prioritize patching as part of routine Chrome updates rather than treating this as an urgent threat.