cve 2026 6304

CVE-2026-6304 is a browser vulnerability disclosed by Google and tracked by Microsoft in their Security Update Guide. The flaw is a use-after-free in the Graphite font shaping library, fixed in Chrome version 147.0.7727.101. While the initial trigger requires a crafted HTML page, the bug is notable because an attacker who has already compromised the renderer process may exploit it to achieve a sandbox escape. This makes CVE-2026-6304 a potential pivot point inside the browser's security model, turning a memory safety issue in a typography subsystem into a more serious enterprise risk. WindowsForum discussions focus on the practical implications for IT administrators managing Chrome deployments.