What is the CVSS score of CVE-2026-7346?

CVE-2026-7346 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7346?

A memory corruption vulnerability in Google Chrome versions prior to 147.0.7727.138 allows attackers to compromise desktop systems by directing employees to crafted websites, exposing sensitive data…. A patch is available.

How to fix or mitigate CVE-2026-7346?

Within 24 hours: Inventory Chrome desktop deployments and verify automatic update status; notify users to expect a mandatory browser update. Within 7 days: Deploy Chrome 147.0.7727.138 or later to all desktops through managed software deployment or automatic update mechanisms, prioritizing security-sensitive teams and client-facing systems. Within 30 days: Confirm deployment completion through asset management systems, update vulnerability compliance records, and monitor endpoint logs for exploitation attempts targeting unpatched systems.

Google Chrome CVE-2026-7346

HIGH

Buffer Overflow (CWE-119)

2026-04-28 Chrome

Buffer Overflow Google

8.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote crafted page needs no privileges but requires the user to visit it (UI:R); OOB read/write yields high confidentiality and integrity impact within the unchanged renderer scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:49 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.1 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory access in Google Chrome's Tint shader compiler (part of the Dawn/WebGPU stack) affects desktop builds prior to 147.0.7727.138 and lets a remote attacker who lures a victim to a crafted HTML page read or corrupt memory outside intended bounds. Rated High by Chromium and CVSS 8.1, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the technical impact is total per CISA SSVC.

Technical ContextAI

Tint is Google's WGSL (WebGPU Shading Language) compiler, a core component of the Dawn WebGPU implementation embedded in Chromium. It translates web-supplied shader source into platform backend representations, so it processes attacker-controllable input whenever a page uses the WebGPU API. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), meaning Tint mishandles a length/index check while parsing or compiling a crafted shader, permitting reads or writes past an allocated buffer. Affected surface is identified in CPE data as cpe:2.3:a:google:chrome (all versions below the fixed build), and the same code ships downstream in Chromium-based browsers and Red Hat/SUSE Chromium packages per the vendor tags.

RemediationAI

Vendor-released patch: 147.0.7727.138 - upgrade Google Chrome to 147.0.7727.138 or later on all desktop platforms, which for most users happens via Chrome's automatic updater after a browser relaunch; verify via chrome://settings/help. Users of Chromium-based or distro-packaged builds (Red Hat, SUSE) should apply the corresponding vendor update as it becomes available. As an interim compensating control before patching, restrict exposure to the WebGPU attack surface by disabling WebGPU (set chrome://flags/#enable-unsafe-webgpu to Disabled or push the enterprise policy that gates WebGPU/GPU acceleration); the trade-off is broken functionality for sites and web apps that rely on GPU compute or graphics. Refer to the Chrome release advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html) for confirmation of the fixed build.