What is the CVSS score of CVE-2026-7333?

CVE-2026-7333 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7333?

A critical sandbox escape vulnerability in Google Chrome (CVE-2026-7333) could allow attackers to break out of the browser's security sandbox and potentially compromise user systems when victims…. A patch is available.

How to fix or mitigate CVE-2026-7333?

Within 24 hours, coordinate with IT operations to obtain and validate Chrome 147.0.7727.138; publish an emergency update advisory to end users and IT staff highlighting the severity and patching requirement. Within 7 days, ensure all user devices, enterprise Chrome instances, and managed endpoints are updated to 147.0.7727.138 or later, prioritizing systems used by sensitive personnel and those accessing high-value assets. Within 30 days, conduct a comprehensive audit to verify 100% patch compliance across all Chrome installations organization-wide and implement or strengthen automatic update policies to prevent recurrence.

Google Chrome CVE-2026-7333

CRITICAL

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges but requires the victim to load it (UI:R); a GPU-process sandbox escape crosses a privilege boundary (S:C) with total impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:57 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

9.6 (CRITICAL)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU process prior to 147.0.7727.138 lets a remote attacker corrupt memory via a use-after-free when a victim visits a crafted HTML page, potentially breaking out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to the scope change (S:C) inherent to a sandbox escape, though it requires user interaction (visiting a page). There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not on CISA KEV.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's GPU component, the privileged process that handles graphics acceleration (GPU command buffers, WebGL/WebGPU, video decode, and compositing) on behalf of sandboxed renderer processes. A dangling pointer to freed GPU-side memory can be reallocated with attacker-influenced data and then dereferenced, giving control over freed-object contents. Because the GPU process runs at higher privilege than the renderer sandbox, corrupting it is a classic vector for sandbox escape. Affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser across platforms; downstream rebuilds are tracked by Red Hat and SUSE per the tags.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on all desktop platforms and restart the browser so the new version loads (open Settings > About Chrome to force the update check). Users of Chromium-based downstreams should apply the equivalent Red Hat or SUSE package updates as they become available. If immediate patching is not possible, reduce exposure by limiting browsing to trusted sites and, as a stronger stopgap, disabling GPU/hardware acceleration (Settings > System > 'Use graphics acceleration when available', or launch with --disable-gpu) to shrink the vulnerable GPU-process attack surface - with the trade-off of degraded rendering, video, and WebGL/WebGPU performance. Refer to Google's advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html.