Description
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free condition in Chrome’s video subsystem allows a remote attacker to trigger arbitrary code execution inside the browser’s sandbox. The flaw is triggered by loading a specially crafted HTML page and can allow execution of native code within the sandbox. It is a classic CWE‑416 scenario where memory that has been freed is accessed again.

Affected Systems

Google Chrome versions prior to 147.0.7727.101 are affected. The vulnerability is present in the standard stable channel of the desktop release and likely applies to all variants that contain the same video engine code.

Risk and Exploitability

The CVE has a CVSS score of 8.8, indicating high severity, and while EPSS data is not available, the lack of a public KEV listing suggests the vulnerability is not currently in widespread use. The attack requires a remote adversary to entice a user to visit a malicious HTML page, after which the use‑after‑free can be triggered. If successful, the attacker can execute arbitrary code within the sandbox. Based on the description, it is inferred that the likely attack vector is remote via a crafted web page; knowledge of the specific memory layout is not required due to the vulnerability in the browser code.

Generated by OpenCVE AI on April 17, 2026 at 06:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 147.0.7727.101 or later to apply the patch that fixes the use‑after‑free bug
  • Ensure automatic update is enabled so future patches are applied promptly
  • If immediate update is not possible, avoid opening untrusted or suspicious web pages that could exploit the video handling code

Generated by OpenCVE AI on April 17, 2026 at 06:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6214-1 chromium security update
History

Fri, 17 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Thu, 16 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Video
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 15 Apr 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 15 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Description Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-16T03:56:00.581Z

Reserved: 2026-04-14T18:12:21.625Z

Link: CVE-2026-6302

cve-icon Vulnrichment

Updated: 2026-04-15T19:53:18.787Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-15T20:16:39.320

Modified: 2026-04-17T17:27:39.993

Link: CVE-2026-6302

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-15T00:00:00Z

Links: CVE-2026-6302 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T07:00:08Z

Weaknesses