What is the CVSS score of CVE-2026-6921?

CVE-2026-6921 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-6921?

A sandbox escape vulnerability in Google Chrome on Windows (CVE-2026-6921, CVSS 8.3) could allow attackers to break out of the browser's security boundary if users load a crafted video file,…. A patch is available.

How to fix or mitigate CVE-2026-6921?

Within 24 hours, identify Windows users running Google Chrome and assess which systems access sensitive data or business-critical functions. Within 7 days, deploy Chrome version 147.0.7727.117 or later using your standard update mechanism (MDM policy, auto-update, or manual installation). Complete verification that all Chrome installations have been patched within 30 days.

Google Chrome CVE-2026-6921

EUVD-2026-25253 HIGH

Race Condition (CWE-362)

2026-04-23 Chrome

GHSA-vxp2-rhxg-cr83

Information Disclosure Google Race Condition Microsoft

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted media (AV:N) needs a hard-to-win race (AC:H) and victim interaction (UI:R); sandbox escape crosses a trust boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 24, 2026 - 16:39 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 19:27 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 19:27 NVD

MEDIUM HIGH

CVSS changed

Apr 23, 2026 - 19:27 NVD

5.3 (MEDIUM) 8.3 (HIGH)

Patch available

Apr 23, 2026 - 19:01 EUVD

CVSS changed

Apr 23, 2026 - 18:42 NVD

5.3 (None) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25253

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 16:12 nvd

HIGH 8.3

DescriptionCVE.org

Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 147.0.7727.117 lets a remote attacker exploit a race condition (CWE-362) in the GPU process by luring a victim into loading a crafted video file, potentially breaking out of the browser sandbox. Google rates the Chromium severity Medium, but the CVSS scope-changing vector drives an 8.3 score; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 19th percentile).

Technical ContextAI

The flaw lives in Chrome's GPU process, which handles hardware-accelerated media decoding and compositing and is a privileged component that renderer processes communicate with across the sandbox boundary. CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) indicates that two threads or IPC operations access shared GPU state without adequate locking, and a crafted video file can time decode operations to win the race and corrupt state used across the sandbox boundary. Because the GPU process straddles the renderer/host trust boundary, winning the race can yield a sandbox escape rather than a mere crash. The single affected CPE is cpe:2.3:a:google:chrome (Windows builds), consistent with the vendor's platform-specific advisory.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.117 or later on Windows via the Stable channel update described at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html, then fully restart the browser so the updated GPU process is loaded. In managed environments, push the update through your existing Chrome enterprise/auto-update tooling and confirm relaunch. As an interim compensating control before patching you can disable hardware-accelerated media by turning off 'Use graphics acceleration when available' (or setting the HardwareAccelerationModeEnabled policy to disabled), which forces software decoding and sidesteps the vulnerable GPU-process race - at the cost of higher CPU use and degraded video/graphics performance. User-awareness guidance to avoid opening untrusted video files or sites offers only partial risk reduction and should not substitute for patching.