What is the CVSS score of CVE-2026-6362?

CVE-2026-6362 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6362?

Yes, a patch is available for CVE-2026-6362. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-6362

EUVD-2026-23090 MEDIUM

Use After Free (CWE-416)

2026-04-15 Chrome

Denial Of Service Google Use After Free Memory Corruption

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires user interaction to open a crafted video, so UI:R; only confidentiality impact is low, no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:10 vuln.today

CVSS changed

May 26, 2026 - 18:22 NVD

6.3 (MEDIUM) 4.3 (MEDIUM)

CVSS changed

Apr 16, 2026 - 14:22 NVD

6.3 (MEDIUM)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23090

CVE Published

Apr 15, 2026 - 19:04 nvd

MEDIUM 6.3

CVE Published

Apr 15, 2026 - 19:04 cve.org

MEDIUM 4.3

DescriptionCVE.org

Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory access via use-after-free in Google Chrome’s codec components can be triggered by a crafted video file, affecting versions prior to 147.0.7727.101. Remote attackers can leak limited sensitive memory with user interaction; the flaw is rated High by the Chromium team, but CVSS score is 4.3 and EPSS indicates very low exploitation probability.

Technical ContextAI

The vulnerability resides in the codec subsystem that processes video files within Google Chrome (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). A use‑after‑free condition (CWE‑416) occurs when memory is freed but still referenced, potentially allowing an attacker to read or manipulate dangling pointers. This flaw can be exploited by delivering a malformed video file, leading to out‑of‑bounds memory access and information disclosure.

RemediationAI

Upgrade to Google Chrome version 147.0.7727.101 or later, which contains the patch. The advisory is available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html. Chrome typically updates automatically; users should verify that the browser has restarted to apply the latest version. No workarounds are provided; avoid opening untrusted video files as a temporary measure, though this does not fully mitigate the risk.