CVE-2026-6309 is a use-after-free vulnerability in the Viz component of Google Chrome prior to version 147.0.7727.101. It allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability is rated as high severity by Chromium security. No CVSS score is currently assigned, and no explicit remediation level is provided in the available data. The vulnerability affects desktop Chrome versions before 147.0.7727.101. The vendor advisory is available but does not explicitly confirm patch status in the provided data.

If exploited, this vulnerability could allow an attacker with control over the renderer process to escape the sandbox environment, potentially leading to greater system compromise beyond the browser sandbox. However, exploitation requires prior compromise of the renderer process. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Users should update to Chrome version 147.0.7727.101 or later once available. Until then, no specific mitigations are detailed in the advisory.