Cyber Posture

CVE-2026-6303

High

Published: 15 April 2026

Published
15 April 2026
Modified
17 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0005 14.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2026-6303 is a use-after-free vulnerability (CWE-416) in the Codecs component of Google Chrome prior to version 147.0.7727.101. Published on 2026-04-15, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.

A remote attacker can exploit this flaw by crafting an HTML page that triggers the use-after-free condition in Codecs, enabling arbitrary code execution within the browser's sandbox. Exploitation requires user interaction, such as visiting the malicious page, but needs no privileges or special access.

Mitigation is available via the Chrome stable channel update to version 147.0.7727.101 or later. Additional details are provided in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and the Chromium issue tracker at https://issues.chromium.org/issues/496282147.

Details

CWE(s)
CWE-416

Affected Products

google
chrome
≤ 147.0.7727.101

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in Chrome Codecs enables arbitrary code execution via crafted HTML page, directly facilitating drive-by compromise (T1189) and exploitation for client execution (T1203) with user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References