What is the CVSS score of CVE-2026-7350?

CVE-2026-7350 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7350?

Google Chrome's WebMIDI component contains a high-severity sandbox escape vulnerability (versions prior to 147.0.7727.138) that could allow an attacker to gain unauthorized access beyond browser…. A patch is available.

How to fix or mitigate CVE-2026-7350?

Within 24 hours, audit your organization's Chrome deployment to identify systems running versions prior to 147.0.7727.138. Within 7 days, deploy Chrome 147.0.7727.138 or later through your standard patch management process, prioritizing critical systems and users. Within 30 days, complete deployment across all systems and verify successful patch installation via inventory tools or deployment reports.

Google Chrome CVE-2026-7350

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page (AV:N) needs victim interaction (UI:R) and complex memory grooming plus a pre-compromised renderer (AC:H); sandbox escape crosses the trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:52 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.3 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.

Technical ContextAI

WebMIDI is the Chromium browser subsystem implementing the W3C Web MIDI API, which lets web pages enumerate and communicate with MIDI devices; this interface bridges untrusted page JavaScript to more privileged browser-process code that manages device I/O. The flaw is a use-after-free (CWE-416): an object is freed while a dangling reference to it remains reachable, and subsequent access to that stale pointer lets an attacker corrupt memory in a context that spans the renderer/browser trust boundary, which is why the CVSS scope is Changed (S:C). The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop browser; because Chromium is the shared upstream, Red Hat and SUSE (reflected in the tags) also ship rebuilds affected by the same defect.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later (Stable channel) as described at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html; on managed fleets, force the browser relaunch so the update actually takes effect, since Chrome only completes the update on restart. Red Hat and SUSE users should apply their respective distribution's Chromium package update once published. No official standalone workaround is provided, but because exploitation requires the WebMIDI path, compensating controls until patching include disabling MIDI device access via enterprise policy or blocking the Web MIDI permission (which breaks legitimate browser-based MIDI/music applications), and enforcing site-isolation and standard sandbox hardening; note these only raise the bar and do not remove the underlying use-after-free.