What is the CVSS score of CVE-2026-7339?

CVE-2026-7339 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7339?

Google Chrome versions prior to 147.0.7727.138 contain a vulnerability enabling remote code execution on employee devices when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-7339?

Within 24 hours, notify all Chrome users of patch availability and activate monitoring for exploitation attempts. Over the next 7 days, deploy Chrome 147.0.7727.138 or later through enterprise update channels to all managed endpoints, prioritizing systems with high-value users or sensitive data access. Within 30 days, complete rollout across all Chrome installations, validate successful deployments, and retire previous versions from supported baselines.

Google Chrome CVE-2026-7339

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-28 Chrome

Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth but required user interaction (UI:R); heap overflow enables full renderer memory-corruption impact, so C/I/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:47 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to trigger a heap buffer overflow when a victim visits a crafted HTML page, potentially leading to memory corruption and arbitrary code execution within the renderer process. Reported internally by the Chrome team and rated Medium by Chromium, it carries a CVSS of 8.8 driven by high confidentiality/integrity/availability impact plus required user interaction. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 8th percentile), indicating no observed exploitation activity.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that handles peer-to-peer audio, video, and data channels, involving complex parsing of media/SDP and network payloads in native C++ code. The flaw is a CWE-122 heap-based buffer overflow, meaning attacker-controlled input causes a write past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object data. Because WebRTC processing is reachable from untrusted web content, a malicious page can drive the vulnerable code path. The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build), and the same underlying Chromium code is redistributed by downstream vendors (tags reference Red Hat and SUSE), so Chromium-derived browsers may also be affected.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Stable channel (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html); relaunch the browser to ensure the new build is active, since Chrome only applies a downloaded update on restart. Enterprises managing Chrome should confirm auto-update is not blocked and push the version through their management tooling, and Red Hat/SUSE users should apply the corresponding chromium package update when published by their distribution. If immediate patching is not possible, a compensating control is to disable WebRTC-dependent functionality (for example via enterprise policy or an extension that blocks WebRTC) and avoid untrusted sites - the trade-off is that this breaks video conferencing, voice chat, and other real-time features that rely on WebRTC.