What is the CVSS score of CVE-2026-6318?

CVE-2026-6318 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2026-6318?

Chrome versions below 147.0.7727.101 contain a high-severity arbitrary code execution vulnerability affecting all users who visit malicious websites; attackers can execute code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-6318?

Within 24 hours: Identify all Chrome deployments across the organization and verify current versions. Within 7 days: Deploy Chrome 147.0.7727.101 or later via your endpoint management system (MDM/SCCM/Intune) to all affected devices; prioritize systems handling sensitive data. Within 30 days: Confirm 100% deployment completion through endpoint telemetry and implement automated Chrome update policies to prevent version drift.

Chrome CVE-2026-6318

EUVD-2026-23078 HIGH

Use After Free (CWE-416)

2026-04-15 Chrome

Use After Free Memory Corruption Google Denial Of Service RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 10:23 vuln.today

CVSS changed

Apr 16, 2026 - 10:22 NVD

8.8 (HIGH)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23078

Analysis Generated

Apr 15, 2026 - 19:45 vuln.today

CVE Published

Apr 15, 2026 - 19:04 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution within Chrome's sandbox affects all versions prior to 147.0.7727.101 via crafted HTML pages exploiting a use-after-free in codec processing. Remote attackers require user interaction (visiting a malicious page) but need no authentication. CVSS 8.8 (High) with network attack vector, low complexity, and high impact across confidentiality, integrity, and availability. Google patched this in the stable channel update released April 15, 2026. No public exploit code or CISA KEV listing identified at time of analysis, though Chromium issue tracker #495996858 indicates vendor-confirmed vulnerability. The sandbox containment limits initial exploitation to Chrome's restricted environment, not direct system compromise.

Technical ContextAI

Use-after-free (CWE-416) is a memory corruption vulnerability where code attempts to access previously freed memory regions. In Chrome's codec subsystem (responsible for audio/video media processing), this occurs when object lifecycle management fails - typically when a codec handler deallocates memory while another component still holds a reference. Successful exploitation allows attackers to control freed memory contents, potentially redirecting execution flow. Chrome's multi-process architecture sandboxes renderer processes where codecs operate, limiting initial compromise scope. However, combined with sandbox escape exploits, this becomes a critical browser security bypass. The vulnerability resides in cpe:2.3:a:google:chrome versions below 147.0.7727.101 across all platforms (Windows, macOS, Linux, ChromeOS). Codec vulnerabilities are particularly valuable in exploit chains because media parsing occurs automatically during page rendering, providing reliable attack surfaces through embedded media elements.

RemediationAI

Update Google Chrome to version 147.0.7727.101 or later immediately via Chrome's built-in updater (Settings → About Chrome triggers automatic update) or download from google.com/chrome. Enterprise deployments should push version 147.0.7727.101 through managed update channels per Google's admin documentation. Chromium-based browser users should check vendor-specific advisories and update to versions incorporating the upstream fix. Temporary workarounds if patching is delayed: disable JavaScript (Settings → Privacy and Security → Site Settings → JavaScript) to prevent automatic codec exploitation via scripted media loading, though this severely impacts browser functionality. Alternatively, use browser isolation technologies (remote browser isolation, virtualized browsing) to contain potential compromise. Network-level controls provide minimal value since attack delivery is HTTPS web traffic. Advisory reference: http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and Chromium bug tracker https://issues.chromium.org/issues/495996858.