What is the CVSS score of CVE-2026-7347?

CVE-2026-7347 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7347?

A remote code execution vulnerability in Chrome Remote Desktop (versions prior to 147.0.7727.138) could allow attackers to compromise remote access sessions used by employees and support staff.. A patch is available.

How to fix or mitigate CVE-2026-7347?

Within 24 hours: identify all Chrome Remote Desktop installations across the enterprise using your device management and CMDB systems to assess exposure scope. Within 7 days: deploy Chrome version 147.0.7727.138 or later to all affected endpoints using your standard patch management process, prioritizing systems used for remote administration and user support. Within 30 days: conduct automated compliance scanning to verify 100% patching coverage and document remediation completion.

Google Chrome CVE-2026-7347

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-triggered via session traffic (AV:N) with no auth or interaction (PR:N/UI:N), but AC:H for the use-after-free race; full code execution in the process gives C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:50 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.1 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.1

DescriptionCVE.org

Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.

Technical ContextAI

Chromoting is the internal engine behind Chrome Remote Desktop, handling the network protocol, session negotiation, and media/input streaming between a host and client over Chrome. The root cause is CWE-416 (Use After Free): memory associated with a Chromoting object is freed while a dangling reference to it remains, and subsequent access to that stale pointer allows an attacker who controls the timing and content of session network traffic to reclaim the freed allocation with attacker-influenced data, converting the dangling reference into controlled memory corruption and ultimately code execution in the Chrome process. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all versions below the fixed build), and the class of bug is typical of the C++ object-lifetime issues that dominate Chromium's high-severity reports.

RemediationAI

Update to Chrome 147.0.7727.138 or later on all desktop platforms - Vendor-released patch: 147.0.7727.138 - by triggering Chrome's built-in updater and relaunching, and ensure managed fleets receive the update via enterprise policy or endpoint management. For Chromium-derived and vendor-packaged builds, apply the corresponding fixed packages once Red Hat and SUSE ship them. As an interim compensating control, disable or uninstall Chrome Remote Desktop so the vulnerable Chromoting code path is not exercised, and restrict remote-desktop connectivity to trusted networks; the trade-off is loss of remote-access functionality for users who rely on it. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the tracking record at https://vuldb.com/vuln/360074.