What is the CVSS score of CVE-2026-7348?

CVE-2026-7348 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7348?

Unpatched Google Chrome installations (versions prior to 147.0.7727.138) are vulnerable to remote code execution if employees access malicious web content, potentially exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-7348?

Within 24 hours, publish a mandatory security advisory directing all Chrome users to update to version 147.0.7727.138 or later via Settings > About Google Chrome (auto-update) or manual download from google.com/chrome; simultaneously notify system administrators to prepare for enterprise deployment. Within 7 days, deploy patches to 90% of endpoints using Group Policy (Windows), configuration profiles (macOS), and MDM/EMM for mobile Chrome instances, prioritizing teams handling sensitive information. By day 30, achieve 100% patch compliance across all platforms, verify remediation via endpoint vulnerability scanning, and document patch completion in your vulnerability management system.

Google Chrome CVE-2026-7348

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with low complexity and no auth, but requires the victim to open it (UI:R); in-renderer code execution keeps scope unchanged with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:51 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's media Codecs subsystem, the code responsible for decoding audio/video streams embedded in web content. A use-after-free occurs when a pointer to freed heap memory is reused, allowing an attacker who controls heap layout to place attacker-controlled data where a stale object is expected, corrupting object state or vtables to hijack control flow. Because codec parsing runs on richly attacker-influenced input (media containers/streams referenced from an HTML page), it is a classic memory-corruption attack surface. The affected CPE is cpe:2.3:a:google:chrome, i.e. the Chrome browser application across pre-147.0.7727.138 builds; the arbitrary code execution is explicitly noted as occurring inside the renderer sandbox, so a further sandbox-escape would be needed for full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on all desktop platforms (Windows, macOS, Linux) via the built-in updater or by relaunching the browser, per https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. For Chromium-based and vendor-repackaged builds, apply the equivalent update from Red Hat/SUSE or the respective vendor as it ships. Where immediate patching is not possible, reduce exposure by restricting untrusted browsing, deploying enterprise policy to force-update Chrome, and considering a stricter site-isolation posture; disabling the sandbox is not a mitigation and would worsen risk. As a codec-focused UAF, temporarily limiting exposure to untrusted media-heavy sites lowers likelihood but does not eliminate the flaw, so treat it only as a stopgap until the update is applied.