CVE-2026-6303
Published: 15 April 2026
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2026-6303 is a use-after-free vulnerability (CWE-416) in the Codecs component of Google Chrome prior to version 147.0.7727.101. Published on 2026-04-15, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this flaw by crafting an HTML page that triggers the use-after-free condition in Codecs, enabling arbitrary code execution within the browser's sandbox. Exploitation requires user interaction, such as visiting the malicious page, but needs no privileges or special access.
Mitigation is available via the Chrome stable channel update to version 147.0.7727.101 or later. Additional details are provided in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and the Chromium issue tracker at https://issues.chromium.org/issues/496282147.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Use-after-free in Chrome Codecs enables arbitrary code execution via crafted HTML page, directly facilitating drive-by compromise (T1189) and exploitation for client execution (T1203) with user interaction.