What is the CVSS score of CVE-2026-7335?

CVE-2026-7335 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7335?

Google Chrome versions prior to 147.0.7727.138 contain a remote code execution vulnerability that enables attackers to execute code within the browser sandbox when users visit crafted webpages.. A patch is available.

How to fix or mitigate CVE-2026-7335?

Within 24 hours, communicate Chrome update requirement to all end users and prepare deployment of version 147.0.7727.138 to managed devices via your browser update mechanism. Within 7 days, complete deployment to all managed endpoints and verify completion through endpoint telemetry; generate a compliance report showing Chrome version distribution and flag any systems still running pre-147 versions for immediate remediation. Within 30 days, achieve 100% patching across all managed infrastructure and formally document any exceptions (including personal or BYOD devices) for risk acceptance approval by information security leadership.

Google Chrome CVE-2026-7335

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Web-delivered so AV:N/AC:L/PR:N, but visiting a page is required (UI:R); execution stays in the renderer so scope unchanged (S:U) with total renderer C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:51 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's media subsystem - the pipeline that decodes and renders audio/video content driven by HTML/JavaScript. Use-after-free occurs when a heap object is freed but a dangling pointer to it is later dereferenced, letting an attacker groom the heap to place attacker-controlled data where the freed object was and gain control of execution. Because media playback is reachable directly from web content (e.g. HTML5 <video>/<audio>, MSE, or WebCodecs paths), a malicious page can drive the vulnerable code without any plugin. The affected code runs in the sandboxed renderer process (cpe:2.3:a:google:chrome), which is the browser's primary attack surface for hostile web content.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Stable channel (Help > About Google Chrome, then relaunch), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. In managed environments, push the update through your existing browser-management tooling and force a relaunch, since the fix is inert until the browser restarts; users on Chromium-based distributions should apply Red Hat/SUSE package updates as they become available. Until patched, reduce exposure by restricting untrusted browsing and, where feasible, disabling or restricting media autoplay and site permissions to limit automatic media processing - noting this can break legitimate video/audio sites - and enabling Chrome's site isolation (default on) to preserve the sandbox boundary that already constrains this bug's impact.