Description
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds read was discovered in the Media component of Google Chrome before version 147.0.7727.101. The flaw permits a remote adversary to trigger a crafted HTML page that, when a user performs specific UI gestures, can lead to arbitrary code execution. The vulnerability falls under CWE‑125 and is classified as high severity by Chromium security.

Affected Systems

The issue affects any installation of Google Chrome running a version earlier than 147.0.7727.101. The vulnerability is limited to the Chrome browser; no other Google or third‑party products are listed as affected.

Risk and Exploitability

Because exploitation requires a user to visit a maliciously constructed web page and perform certain gestures, the attack vector relies on social engineering to get the user to interact with the page. The CVSS score is 7.5, and the EPSS score is <1%, indicating a low probability of exploitation, yet the problem remains high risk due to remote code execution potential. The vulnerability is not currently listed in CISA’s KEV catalog.

Generated by OpenCVE AI on April 17, 2026 at 07:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 147.0.7727.101 or later.
  • Enable automatic updates or manually check for updates via Chrome Settings > About Chrome.
  • If an immediate update is not possible, block sites that deliver media content using a browser extension or content‑filtering tool to reduce the opportunity for exploitation.

Generated by OpenCVE AI on April 17, 2026 at 07:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6214-1 chromium security update
History

Fri, 17 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Thu, 16 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read in Media Leading to Remote Code Execution via Crafted HTML Page Google Chrome: Chromium: Google Chrome: Arbitrary code execution via out-of-bounds read in Media component
References
Metrics threat_severity

None

 threat_severity

Critical

Thu, 16 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 22:30:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read in Media Leading to Remote Code Execution via Crafted HTML Page

Wed, 15 Apr 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 15 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Description Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-125
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-16T09:57:13.931Z

Reserved: 2026-04-14T18:12:23.842Z

Link: CVE-2026-6308

cve-icon Vulnrichment

Updated: 2026-04-16T09:57:07.710Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-15T20:16:40.153

Modified: 2026-04-17T17:26:59.587

Link: CVE-2026-6308

cve-icon Redhat

Severity : Critical

Publid Date: 2026-04-15T19:04:52Z

Links: CVE-2026-6308 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T08:00:11Z

Weaknesses