CVE-2026-6318

CVE-2026-6318 is a use-after-free vulnerability in the Codecs component of Google Chrome versions prior to 147.0.7727.101 that permits remote attackers to execute arbitrary code within the Chrome sandbox through a maliciously crafted HTML page. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring minimal complexity and only user interaction, resulting in high confidentiality, integrity, and availability impacts. While Chromium has classified this as medium severity, the exploit is remotely accessible with low technical barriers to entry. There is no current evidence of active exploitation in the wild, no known public exploit code, and the vulnerability remains on the inactive Hot List, suggesting limited community attention at this time. The EPSS score of 0.00048 indicates this threat ranks lower than most CVEs in terms of near-term exploitation probability.