CVE-2026-6301

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Google	Chrome	>= 147.0.7727.101, < 147.0.7727.101

References

https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/495273999Permissions Required

Timeline

Published: Apr 15, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-630108.7Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-p CVE-2026-630119.4Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Con CVE-2026-630154.3Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issu CVE-2026-630165.3Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-offici CVE-2026-630179.0Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administra CVE-2026-630184.8Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software before version 1.16.18 CVE-2026-63028.8Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-630203.1A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: CVE-2026-630216.5Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before readi CVE-2026-630275.3Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow CVE-2026-630285.1Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervi CVE-2026-63038.8Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a