What is the CVSS score of CVE-2026-7342?

CVE-2026-7342 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7342?

Google Chrome and Android WebView versions below 147.0.7727.138 contain a use-after-free vulnerability (CVE-2026-7342, CVSS 8.8) that allows remote code execution within the browser sandbox when…. A patch is available.

How to fix or mitigate CVE-2026-7342?

Within 24 hours, inventory all Android devices running Chrome or applications using WebView in your organization to identify deployment scope. Within 7 days, deploy Chrome for Android update to version 147.0.7727.138 or later through your mobile device management platform, prioritizing devices with administrative or financial access. Within 30 days, verify patch deployment across at least 95% of managed Android devices via MDM reporting and establish ongoing vulnerability scanning to catch future Chrome updates missed in initial rollout.

Google Chrome CVE-2026-7342

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery (AV:N/AC:L/PR:N) needs the victim to open content (UI:R); sandbox-contained code execution still yields high C/I/A within the renderer with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:48 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.3 (HIGH) 8.8 (HIGH)

CVSS changed

Apr 29, 2026 - 13:23 NVD

7.3 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.

Technical ContextAI

The vulnerability lives in Chrome's WebView, the embeddable browser engine (built on Chromium/Blink) used to render web content inside Android apps and the Chrome browser itself. CWE-416 (Use After Free) means the code continues to reference heap memory after it has been freed; an attacker who controls heap layout via crafted HTML/JavaScript can cause a dangling pointer to be reused, corrupting object state and steering control flow toward attacker-chosen code. The CPE provided (cpe:2.3:a:google:chrome) identifies Google Chrome as the affected application, though the description specifically scopes impact to the Android WebView build prior to 147.0.7727.138.

RemediationAI

Vendor-released patch: 147.0.7727.138 - upgrade Google Chrome / Android WebView to 147.0.7727.138 or later, which is the primary and complete fix; on Android this typically arrives via Google Play updates to the 'Android System WebView' and Chrome apps, so ensure automatic app updates are enabled and force-update managed fleets via MDM. Downstream users on Red Hat or SUSE should apply the corresponding Chromium package update from those vendors once published. No reliable configuration workaround fully neutralizes a renderer memory-corruption bug; as interim compensating controls you can reduce exposure by restricting untrusted web content (enforce Safe Browsing, block risky categories at the network proxy) and, for apps embedding WebView, avoid loading untrusted third-party HTML - with the trade-off that these controls reduce but do not eliminate drive-by risk. Advisory references: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and https://vuldb.com/vuln/360059.