What is the CVSS score of CVE-2026-7345?

CVE-2026-7345 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7345?

Google Chrome versions before 147.0.7727.138 contain a high-severity sandbox escape that could grant system-level access to attackers who have already compromised the browser's renderer process.. A patch is available.

How to fix or mitigate CVE-2026-7345?

Within 24 hours, query your endpoint management and software distribution systems to identify all Chrome instances running versions prior to 147.0.7727.138, and confirm patch availability in your update channels. Within 7 days, deploy Chrome 147.0.7727.138 or later to all managed endpoints using your standard update process, with priority to systems with restricted browsing policies. Within 30 days, generate a compliance report verifying 100% of Chrome instances are updated and establish automated patch deployment rules to eliminate version-drift on future releases.

Google Chrome CVE-2026-7345

HIGH

Improper Input Validation (CWE-20)

2026-04-28 Chrome

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the need for a crafted page plus an already-compromised renderer; S:C captures the sandbox escape granting full browser-process compromise (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:49 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.2 (HIGH) 8.3 (HIGH)

CVSS changed

Apr 29, 2026 - 13:23 NVD

7.2 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted HTML to the Feedback component, which insufficiently validates untrusted input. The flaw (CWE-20, Chromium severity High, CVSS 8.3 with a scope change) is a second-stage privilege boundary bypass rather than an initial-access bug. No public exploit is identified at time of analysis, and the EPSS score is very low (0.05%, 14th percentile), consistent with a vulnerability that requires a prior renderer compromise to reach.

Technical ContextAI

The affected component is the Feedback feature within Chromium's browser process, reachable across the renderer-to-browser IPC/Mojo boundary. Chrome's multi-process architecture isolates untrusted web content inside a sandboxed renderer; a separate memory-safety or logic bug is normally needed to compromise that renderer, and this issue then abuses insufficient validation of input passed from the (now attacker-controlled) renderer to the more-privileged browser process, enabling a sandbox escape. CWE-20 (Improper Input Validation) is the root-cause class: the higher-privileged Feedback code trusts data that a compromised renderer can forge. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Chrome Stable channel (Help > About Google Chrome, then relaunch) as the primary and complete fix, per https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Red Hat and SUSE users should apply their respective Chromium package updates once published. Because exploitation requires a prior renderer compromise, meaningful compensating controls until patching center on hardening the browser attack surface: enable Chrome's Enhanced Safe Browsing and site isolation (default) to reduce the chance of the initial renderer bug being reached, and consider enforcing auto-update via enterprise policy so the fixed build rolls out without user action. There is no need to disable the Feedback feature specifically, and no vendor workaround is offered - the trade-off of any browser-lockdown control is reduced functionality for what is a chained, low-EPSS issue, so prompt patching is preferable to mitigations.