CVE-2026-6311
Published: 15 April 2026
Summary
CVE-2026-6311 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-6311 is an uninitialized use vulnerability (CWE-457) in the Accessibility component of Google Chrome on Windows versions prior to 147.0.7727.101. The flaw resides in the renderer process and enables a remote attacker who has already compromised that process to potentially escape the Chrome sandbox via a crafted HTML page. Chromium rates it as High severity with a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Exploitation requires a remote attacker to first compromise the renderer process, likely through a separate vulnerability, followed by user interaction such as loading a malicious HTML page over the network. With high attack complexity, no privileges, and changed scope, successful exploitation allows sandbox escape, potentially leading to full system compromise with high impacts on confidentiality, integrity, and availability.
Google addressed the issue in Chrome 147.0.7727.101 via the stable channel update for desktop. Mitigation involves updating to this version or later. Additional details are available in the Chrome Releases announcement at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and the Chromium issue at https://issues.chromium.org/issues/498201025.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23064
Vulnerability details
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables sandbox escape from the compromised renderer process via crafted HTML, directly facilitating privilege escalation (T1068) and client-side code execution outside the sandbox (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of software flaws such as the uninitialized use vulnerability in Chrome's renderer process, directly mitigating this CVE through patching to version 147.0.7727.101 or later.
SC-39 mandates process isolation to confine compromised renderer processes within the Chrome sandbox, reducing the impact of sandbox escape attempts via accessibility flaws.
SI-16 enforces memory protections like DEP and ASLR that hinder exploitation of uninitialized use vulnerabilities in the renderer process for code execution or sandbox escape.