CVE-2015-6789

What it actually does

Race condition in MutationObserver allows unanticipated object deletion leading to use-after-free, enabling denial of service or potential remote code execution.

Why it matters to the business

Older browser versions remain exposed to crashes or compromise when users visit malicious web content, increasing support costs and risk for organizations still running outdated Chrome deployments years after disclosure.

How an attack unfolds

An attacker hosts a webpage containing crafted JavaScript that rapidly mutates the DOM while MutationObserver callbacks are active, winning the race to delete objects and trigger the use-after-free condition.

How to fix it

Upgrade Google Chrome to version 47.0.2526.80 or later; ensure automatic updates are enabled and audit any pinned older versions across the fleet.

How to confirm the fix worked

Confirm all instances report version 47.0.2526.80 or newer via chrome://version or enterprise management consoles; retest any internal web applications that previously exercised heavy MutationObserver usage.

Typical attack path

1. Serve malicious webpage to target browser
2. Execute JavaScript that schedules concurrent DOM mutations and observer callbacks
3. Trigger object deletion during observer processing to induce use-after-free
4. Leverage freed memory for denial of service or further memory corruption

How to detect it

Review browser crash logs and memory dumps for use-after-free signatures in Blink rendering paths; correlate with web request logs showing visits to untrusted domains around the time of the crash.

What your security team should do

• Immediately enforce browser updates to 47.0.2526.80+ via policy
• Block or sandbox legacy browser instances that cannot be updated
• Monitor for browser crash reports correlated with web navigation
• Review web application code for heavy reliance on MutationObserver and add defensive checks