What is the CVSS score of CVE-2026-7341?

CVE-2026-7341 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7341?

Google Chrome versions prior to 147.0.7727.138 contain a high-severity use-after-free vulnerability in the WebRTC component that allows remote code execution within the browser sandbox if a user…. A patch is available.

How to fix or mitigate CVE-2026-7341?

Within 24 hours, audit the Chrome versions currently deployed across the organization and prepare a deployment package for version 147.0.7727.138 or later; test the patch in a non-production environment and verify WebRTC functionality across key business applications. Within 7 days, begin staged rollout starting with non-critical systems to ensure compatibility before enterprise-wide deployment. Within 30 days, ensure 95% of desktop endpoints have been updated to Chrome 147.0.7727.138 or later, with remaining systems on a documented remediation plan.

Google Chrome CVE-2026-7341

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth but required user interaction (UI:R); high C/I/A from code execution, S:U because impact stays within the renderer sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:47 vuln.today

Severity Changed

Apr 29, 2026 - 14:38 NVD

CRITICAL HIGH

CVSS changed

Apr 29, 2026 - 14:38 NVD

9.8 (CRITICAL) 8.8 (HIGH)

CVSS changed

Apr 29, 2026 - 13:23 NVD

9.8 (CRITICAL)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.

Technical ContextAI

The flaw lives in WebRTC, the real-time communication stack Chromium uses for peer-to-peer audio, video, and data channels; because WebRTC processes untrusted media/session data automatically when a page instantiates an RTCPeerConnection or related APIs, it is a recurring source of memory-safety bugs. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference to it remains reachable, and subsequent access to that freed memory allows an attacker who controls heap layout to redirect execution or corrupt state. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all versions below the fixed build). Chromium's multi-process architecture means WebRTC runs in the sandboxed renderer, so the initial impact is contained to that low-privilege process rather than the host OS.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Stable channel; installations that use Chrome's automatic updater will receive it on next restart, so verify by relaunching and checking chrome://settings/help. See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and VulDB entry https://vuldb.com/vuln/360069. Downstream Chromium rebuilds should apply the equivalent Red Hat/SUSE distribution updates. If patching cannot be completed immediately, a targeted compensating control is to disable or restrict WebRTC - for example via enterprise policy (WebRtcAllowLegacyTLSProtocols/URL-based restrictions) or by blocking untrusted sites from using RTCPeerConnection - which reduces the attack surface but breaks legitimate video-conferencing and voice features; combined with restricting general web browsing to trusted destinations, this narrows exposure until the update is deployed.