What is the CVSS score of CVE-2026-7338?

CVE-2026-7338 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7338?

Google Chrome versions prior to 147.0.7727.138 contain a heap corruption vulnerability in the Cast component that enables local network attackers to achieve code execution within the browser process.. A patch is available.

How to fix or mitigate CVE-2026-7338?

Within 24 hours, identify all Chrome installations and flag systems on shared network segments as priority targets for immediate patching. Within 7 days, deploy Chrome version 147.0.7727.138 or later across all endpoints using your standard deployment mechanism (MDM, Group Policy, or direct channels). Complete deployment verification within 30 days, confirming via endpoint telemetry that no Chrome instances remain on unpatched versions prior to 147.0.7727.138.

Google Chrome CVE-2026-7338

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent-network reach (AV:A) via Cast, no auth or interaction (PR:N/UI:N), but winning the UAF race is hard (AC:H), with full impact within the unchanged browser process scope.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:48 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.5 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.

Technical ContextAI

The vulnerability lives in Chrome's Cast feature, which implements Google Cast (Chromecast) device discovery and media streaming over the local network, typically using mDNS/DIAL discovery and the Cast protocol over TCP/UDP. The root cause is CWE-416 (Use After Free): the Cast code path frees a heap object while a dangling reference remains reachable, so subsequent use of that reference operates on freed/reallocated memory, producing heap corruption. Because Cast processes attacker-influenced network traffic to identify and communicate with casting endpoints, a crafted stream of packets can drive the object lifecycle into the freed-then-reused state. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - the desktop Chrome browser across platforms (Red Hat and SUSE tags indicate downstream Linux distribution rebuilds are also affected).

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.138 - upgrade all desktop Chrome installations to 147.0.7727.138 or later via the Stable channel; Chrome typically auto-updates, so verify the update has applied and restart the browser to load the new binary (chrome://settings/help). Red Hat and SUSE users should apply the corresponding distribution Chromium/Chrome package updates. As an interim compensating control before patching, restrict exposure to the local-network attack surface: because the flaw is reached through Cast on the local segment, disabling media casting / not initiating Cast sessions on untrusted networks and segmenting or isolating clients from untrusted LAN/Wi-Fi peers (e.g. enabling client isolation on shared Wi-Fi, blocking mDNS/Cast discovery traffic between untrusted hosts) reduces reachability - the trade-off is loss of Chromecast/casting functionality on those networks. Advisory references: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and https://vuldb.com/vuln/360086.