Cyber Posture

CVE-2026-6311

High

Published: 15 April 2026

Published
15 April 2026
Modified
17 April 2026
KEV Added
Patch
CVSS Score 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0003 8.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6311 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 requires timely identification, reporting, and correction of software flaws such as the uninitialized use vulnerability in Chrome's renderer process, directly mitigating this CVE through patching to version 147.0.7727.101 or later.

prevent

SC-39 mandates process isolation to confine compromised renderer processes within the Chrome sandbox, reducing the impact of sandbox escape attempts via accessibility flaws.

prevent

SI-16 enforces memory protections like DEP and ASLR that hinder exploitation of uninitialized use vulnerabilities in the renderer process for code execution or sandbox escape.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The vulnerability enables sandbox escape from the compromised renderer process via crafted HTML, directly facilitating privilege escalation (T1068) and client-side code execution outside the sandbox (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-6311 is an uninitialized use vulnerability (CWE-457) in the Accessibility component of Google Chrome on Windows versions prior to 147.0.7727.101. The flaw resides in the renderer process and enables a remote attacker who has already compromised that process to potentially escape the Chrome sandbox via a crafted HTML page. Chromium rates it as High severity with a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Exploitation requires a remote attacker to first compromise the renderer process, likely through a separate vulnerability, followed by user interaction such as loading a malicious HTML page over the network. With high attack complexity, no privileges, and changed scope, successful exploitation allows sandbox escape, potentially leading to full system compromise with high impacts on confidentiality, integrity, and availability.

Google addressed the issue in Chrome 147.0.7727.101 via the stable channel update for desktop. Mitigation involves updating to this version or later. Additional details are available in the Chrome Releases announcement at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html and the Chromium issue at https://issues.chromium.org/issues/498201025.

Details

CWE(s)

Affected Products

google
chrome
≤ 147.0.7727.101

CVEs Like This One

CVE-2025-2783Same product: Google Chrome
CVE-2026-4452Same product: Google Chrome
CVE-2026-7911Same product: Google Chrome
CVE-2025-1915Same product: Google Chrome
CVE-2026-7925Same product: Google Chrome
CVE-2026-7914Same product: Google Chrome
CVE-2026-7973Same product: Google Chrome
CVE-2026-7994Same product: Google Chrome
CVE-2026-7917Same product: Google Chrome
CVE-2026-7990Same product: Google Chrome

References