CVE-2015-6765

What it actually does

Use-after-free condition in AppCache update job handling allows remote code execution or denial of service when a crafted update job is processed.

Why it matters to the business

Attackers could gain full control of affected user systems via malicious web content, enabling data theft, malware deployment, or service disruption; the vulnerability is long-public and affects legacy browser instances still in use.

How an attack unfolds

An attacker hosts a malicious page that initiates an AppCache update job with specially timed navigation or resource changes, triggering the use-after-free in the update job handler to corrupt memory and execute arbitrary code in the renderer process.

How to fix it

Upgrade Google Chrome to version 47.0.2526.73 or later; disable AppCache where feasible and enforce browser auto-update policies across the fleet.

How to confirm the fix worked

Confirm all endpoints run Chrome 47.0.2526.73 or newer via enterprise management console or about:version; test AppCache functionality on patched builds to verify absence of the flaw.

Typical attack path

1. Victim visits attacker-controlled or compromised website
2. Page triggers AppCache update job with malicious timing or resource manipulation
3. Use-after-free occurs during job processing, leading to memory corruption
4. Attacker leverages corruption for code execution or browser crash

How to detect it

Review browser crash reports and memory dumps for signs of AppCache-related corruption; correlate web proxy logs showing unusual AppCache manifest requests with subsequent renderer process anomalies.

What your security team should do

• Immediately inventory and replace any remaining instances of Chrome older than 47.0.2526.73
• Enable centralized browser update enforcement and block legacy versions via policy
• Monitor for any remaining internal applications that depend on AppCache and migrate them