What is the CVSS score of CVE-2026-6303?

CVE-2026-6303 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2026-6303?

CVE-2026-6303 is a high-severity arbitrary code execution vulnerability in Google Chrome versions prior to 147.0.7727.101 that can be triggered when users visit malicious webpages, compromising…. A patch is available.

How to fix or mitigate CVE-2026-6303?

Within 24 hours: Communicate mandatory Chrome update requirement to all users and verify auto-update settings are enabled organization-wide. Within 7 days: Confirm all Chrome instances have been updated to version 147.0.7727.101 or later via endpoint management tools; block older versions from connecting to corporate network if feasible. Within 30 days: Conduct audit of Chrome deployment across managed and unmanaged devices; document compliance rate and remediate any remaining outdated installations.

Chrome CVE-2026-6303

EUVD-2026-23048 HIGH

Use After Free (CWE-416)

2026-04-15 Chrome

Use After Free Memory Corruption Google Denial Of Service RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 10:22 vuln.today

CVSS changed

Apr 16, 2026 - 10:22 NVD

8.8 (HIGH)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23048

Analysis Generated

Apr 15, 2026 - 19:45 vuln.today

CVE Published

Apr 15, 2026 - 19:04 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution within Google Chrome's sandbox affects all versions prior to 147.0.7727.101 through a use-after-free vulnerability in the codec processing components. Remote attackers can exploit this by tricking users into visiting a malicious webpage, achieving high-severity compromise of confidentiality, integrity, and availability within the sandboxed renderer process. Google has released version 147.0.7727.101 as a stable channel update to address this flaw. No evidence of active exploitation (not in CISA KEV) or public exploit code has been identified at time of analysis, though the simplicity of the attack vector (network-based, low complexity, requiring only user interaction) warrants prioritized patching.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Google Chrome's codec subsystem, which handles media decoding operations for audio and video content embedded in web pages. Use-after-free vulnerabilities occur when code attempts to access memory that has already been deallocated, creating undefined behavior that attackers can manipulate to redirect program execution flow. In Chrome's architecture, codecs operate within the renderer process sandbox, a security boundary designed to isolate untrusted web content from system resources. The affected component processes media data from HTML pages, and the memory corruption can be triggered through specially crafted media files or codec instructions embedded in HTML. The CPE identifier indicates broad impact across all Google Chrome installations (Windows, macOS, Linux) running versions below 147.0.7727.101. Chrome's multi-process architecture means successful exploitation grants arbitrary code execution within the sandbox rather than full system compromise, though sandbox escapes can be chained with this vulnerability to achieve greater impact.

RemediationAI

Immediately update Google Chrome to version 147.0.7727.101 or later through the browser's built-in update mechanism (Settings → About Chrome) or by downloading the latest stable release from google.com/chrome. Enterprise deployments should push this update through existing software management systems (WSUS, SCCM, Jamf, or Google Admin Console for ChromeOS/Chrome Browser Cloud Management). The update applies automatically for most consumer users within 24-48 hours of release due to Chrome's background update service. Official advisory and patch details are available at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html. No effective workaround exists for this vulnerability since disabling codec functionality would break core browser features including HTML5 video and audio playback. Organizations unable to patch immediately should implement compensating controls: restrict Chrome usage to trusted sites only via policy-enforced allowlists (Chrome Enterprise Policy: URLBlocklist/URLAllowlist), deploy network-level web filtering to block known malicious domains, and disable automatic media playback (Chrome flag: chrome://flags/#autoplay-policy set to 'Document user activation is required'). These mitigations significantly impact user experience and should be considered temporary measures only, as they do not eliminate the vulnerability and may be bypassed through social engineering.