What is the CVSS score of CVE-2026-6296?

CVE-2026-6296 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6296?

Yes, a patch is available for CVE-2026-6296. Update the affected software to the latest version immediately.

Google CVE-2026-6296

EUVD-2026-23034 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-04-15 Chrome

Buffer Overflow Google Heap Overflow

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:17 vuln.today

CVSS changed

Apr 15, 2026 - 21:22 NVD

9.6 (None) 9.6 (CRITICAL)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23034

CVE Published

Apr 15, 2026 - 19:04 nvd

CRITICAL 9.6

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

A heap buffer overflow in the ANGLE graphics layer engine in Google Chrome before 147.0.7727.101 may allow a remote attacker to escape the browser sandbox and execute arbitrary code on the host system by convincing a victim to visit a malicious website. Exploitation requires user interaction, and while no active exploitation has been reported, the criticality stems from the potential for full system compromise.