What is the CVSS score of CVE-2026-7349?

CVE-2026-7349 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7349?

Google Chrome desktop versions prior to 147.0.7727.138 contain a remote code execution vulnerability (CVE-2026-7349) exploitable by attackers on the same local network, creating risk of data theft…. A patch is available.

How to fix or mitigate CVE-2026-7349?

Within 24 hours, identify Chrome version distribution across your organization and confirm your patch deployment mechanism can target Chrome 147.0.7727.138 or later; simultaneously notify users of the update requirement. Within 7 days, deploy the patched Chrome version to all affected desktop endpoints through your standard patch management process. Within 30 days, verify patch deployment completion and review network segmentation controls for shared network segments (particularly guest networks and shared office spaces) to reduce local network attack surface.

Google Chrome CVE-2026-7349

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent-network Cast traffic gives AV:A with no auth or interaction (PR:N/UI:N); the use-after-free race is unreliable (AC:H); code runs in-sandbox (S:U) with total process control (C:H/I:H/A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:52 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.5 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.

Technical ContextAI

The vulnerability lives in Chrome's Cast subsystem, the component responsible for discovering and streaming to Google Cast/Chromecast receivers over the local network (typically via mDNS/DIAL discovery and the Cast streaming protocols). CWE-416 (Use After Free) means the code continues to reference a heap object after it has been freed; when incoming Cast network traffic drives the allocation/free lifecycle, an attacker can cause the freed memory to be reallocated with attacker-influenced data and then reused, yielding control over program flow. Because Cast processes untrusted network input, the parsing/streaming path is reachable without the user visiting a page. The affected CPE is cpe:2.3:a:google:chrome (all versions below the fix), and code execution is constrained to the renderer/utility sandbox (scope unchanged, S:U).

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on all desktop platforms, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html); most installs will auto-update on relaunch, so force-close and reopen Chrome to apply the fix, and roll the equivalent rebuilt packages from Red Hat and Suse where Chromium is distributed by the OS vendor. If patching must be deferred, the most targeted compensating control is to reduce exposure of the Cast attack surface: keep affected hosts off untrusted or shared local network segments (the AV:A vector requires adjacency), and use network segmentation/VLANs or host firewall rules to block inbound Cast discovery and streaming traffic (mDNS UDP 5353 and the Cast receiver ports) from untrusted devices - with the trade-off that Chromecast/Cast device discovery and casting will stop working. Because exploitation depends on malicious network traffic reaching the browser, restricting who shares the local segment is the highest-value interim mitigation.