CVE-2026-6318EXPLOITEDPATCHED

google · chrome

CVE-2026-6318: Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code in

Description

Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Products

Vendor	Product	Versions
google	chrome	147.0.7727.101

References

Related News (3 articles)

Tier C

VulDB1d ago

CVE-2026-6318 | Google Chrome up to 147.0.7727.55 Codecs use after free (ID 495996)

→ No new info (linked only)

Tier C

VulDB1d ago

CVE-2026-6318 | Google Chrome up to 147.0.7727.55 Codecs use after free (ID 495996)

→ No new info (linked only)

Tier B

CERT-FR1d ago

Multiples vulnérabilités dans Google Chrome (16 avril 2026)

→ No new info (linked only)

CVSS 3.18.8 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited✅ Yes

Patch available

147.0.7727.101

CWECWE-416

PublishedApr 15, 2026

Last enriched1d agov2

Trending Score53

Source articles3

Independent2

Info Completeness8/14

Missing: cvss, epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-5873EXP

CVE-2026-5873: Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrar

Trending: 61

HIGHCVE-2026-5292EXP

CVE-2026-5292: Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of

Trending: 59

HIGHCVE-2026-6297EXP

CVE-2026-6297: Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to

Trending: 56

HIGHCVE-2026-5281EXPKEV

CVE-2026-5281: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the render

Trending: 54

CRITICALCVE-2026-6298EXP

CVE-2026-6298: Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially se

Trending: 54

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Apr 15, 2026

Discovered by ZDM

Apr 15, 2026

Updated: severity, affectedVersions, activelyExploited

Apr 16, 2026

Actively Exploited

Apr 16, 2026

Patch Available

Apr 16, 2026

Version History

Last enriched 1d ago

v2Tier C1d ago

Updated severity to CRITICAL, added affected version 147.0.7727.55, and marked the vulnerability as actively exploited.

severityaffectedVersionsactivelyExploited

via VulDB

v11d ago

Initial creation