What is the CVSS score of CVE-2026-7344?

CVE-2026-7344 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7344?

Google Chrome for Windows versions prior to 147.0.7727.138 contain a use-after-free vulnerability in the Accessibility component that enables sandbox escape following renderer process compromise,…. A patch is available.

How to fix or mitigate CVE-2026-7344?

Within 24 hours, initiate deployment of Chrome 147.0.7727.138 or later across all Windows endpoints using your standard patch management process. Within 7 days, verify deployment completion and coordinate with your EDR/SOC team to flag successful renderer-process compromises that may attempt this sandbox escape vector. Within 30 days, audit your full Windows Chrome inventory to confirm all endpoints are running 147.0.7727.138 or later.

Google Chrome CVE-2026-7344

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires prior renderer compromise (PR:L) and a chained non-trivial trigger (AC:H) plus victim navigation (UI:R); sandbox escape crosses a trust boundary (S:C) with high impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:58 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.

Technical ContextAI

The vulnerability sits in Chromium's Accessibility (a11y) subsystem, which exposes the accessibility tree describing page structure to assistive technologies and, on Windows, to the platform's UI Automation/MSAA APIs. Because accessibility objects are marshalled across the renderer/browser process boundary, a lifetime-management error there (CWE-416, Use After Free) lets freed memory be referenced and reclaimed, giving an attacker control over object state in the more-privileged browser process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, but the description explicitly scopes impact to the Windows build, since the sandbox-escape surface depends on Windows accessibility integration. Exploitation of the a11y tree is a recurring Chromium sandbox-escape class because it bridges untrusted renderer input into privileged browser-process handling.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on Windows via the Stable channel (Settings > About Chrome, then relaunch), per https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Chromium-based downstreams (Microsoft Edge, and Red Hat/SUSE Chromium packages) should apply their respective vendor updates once published. Because the attack requires a compromised renderer, defense-in-depth is meaningful in the interim: keep Chrome's sandbox enabled (do not launch with --no-sandbox), enable the enhanced Site Isolation and, where manageable, block or restrict untrusted browsing until patched; note these reduce but do not eliminate the sandbox-escape surface. If enterprise-managed, use Chrome Browser Cloud Management/Group Policy to force the minimum version and auto-update, accepting the trade-off of forced relaunches interrupting user sessions.