What is the CVSS score of CVE-2026-7351?

CVE-2026-7351 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7351?

Yes, a patch is available for CVE-2026-7351. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7351

LOW

Race Condition (CWE-362)

2026-04-28 Chrome

Information Disclosure Google Race Condition

3.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Race condition requires winning a timing window (AC:H); user must actively install a malicious extension (UI:R); only cross-origin read access achieved (C:L), with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:53 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

3.1 (LOW)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

LOW 3.1

DescriptionCVE.org

Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's MHTML implementation exposes sensitive data from other browser origins to a malicious extension. Versions prior to 147.0.7727.138 are affected; exploitation requires convincing the target user to install an attacker-controlled Chrome Extension that triggers a race condition in MHTML processing. No public exploit code has been identified and CISA SSVC confirms no exploitation at time of analysis, placing real-world risk significantly below what the product's ubiquity might suggest.

Technical ContextAI

The vulnerability originates in Chrome's MHTML (MIME Encapsulation of Aggregate HTML Documents) subsystem, a format used for serializing complete web pages into a single archive file. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause as a race condition - likely a time-of-check/time-of-use (TOCTOU) flaw - where two concurrent operations in the MHTML parser or renderer share state without adequate synchronization primitives. A crafted Chrome Extension can exploit the resulting timing window to read cross-origin data that the Same-Origin Policy would otherwise prevent. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 147.0.7727.138 across Windows, macOS, and Linux.

RemediationAI

Upgrade Google Chrome to version 147.0.7727.138 or later, which contains the vendor-released patch for this race condition; the stable channel release notes are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. For organizations that cannot immediately deploy the patch, the most effective compensating control is enforcing strict extension allowlisting via Chrome enterprise policy (ExtensionInstallAllowlist and ExtensionInstallBlocklist group policy settings), which directly eliminates the mandatory attack prerequisite - malicious extension installation - with the trade-off of restricting users from installing unapproved extensions. Disabling MHTML file handling via enterprise policy (preventing Chrome from loading .mht files) may reduce attack surface but will not fully eliminate the race condition in all MHTML code paths. Auto-update should be verified as enabled for consumer environments, as Chrome's default update mechanism will apply the patch without user intervention.