CVE-2026-6303 is a use-after-free vulnerability in the Codecs module of Google Chrome before version 147.0.7727.101. Exploitation involves a remote attacker crafting an HTML page that triggers the vulnerability, enabling arbitrary code execution inside the browser sandbox. The vulnerability carries a high severity rating with a CVSS 3.1 base score of 8.8, reflecting its potential impact on confidentiality, integrity, and availability. The vulnerability is tracked under CWE-416 (Use After Free). The vendor has published an advisory but has not explicitly stated the patch or remediation status in the provided data.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the critical nature of this impact. However, there are no known exploits currently in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Until an official fix is confirmed and applied, users should exercise caution when browsing untrusted websites and consider using additional security controls such as sandboxing and browser hardening.