What is the CVSS score of CVE-2026-7352?

CVE-2026-7352 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7352?

A sandbox escape vulnerability in Google Chrome's Media component for Android could allow attackers who have compromised the browser process to further elevate privileges to the operating system…. A patch is available.

How to fix or mitigate CVE-2026-7352?

Within 24 hours, identify all Android devices with Chrome deployed across your organization, specifically those with versions prior to 147.0.7727.138. Within 7 days, distribute and enforce deployment of Google Chrome for Android version 147.0.7727.138 or later through mobile device management (MDM) systems to all managed devices. Within 30 days, verify 100% patch coverage across all Android Chrome instances to eliminate the sandbox escape attack vector.

Google Chrome CVE-2026-7352

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

PR:L because a prior renderer compromise (attacker code already in the sandbox) is required; AC:H for non-trivial UAF grooming; UI:R for page load; S:C with C/I/A:H for the privileged sandbox escape.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:54 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.3 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.

Technical ContextAI

The flaw sits in Chrome's Media subsystem, which handles audio/video decoding and playback pipelines inside the sandboxed renderer and interacts across the browser's multi-process trust boundary. CWE-416 (Use After Free) means an object in the Media code path is freed while a dangling reference remains reachable; re-using that freed memory lets an attacker who already controls the renderer manipulate object lifetimes to corrupt state in a higher-privileged context, achieving a sandbox escape. The provided CPE (cpe:2.3:a:google:chrome:*) is generic and unversioned, but the description scopes the issue specifically to the Android build; the CVSS scope-change flag (S:C) reflects that a successful exploit crosses the renderer/browser boundary. It is tracked in Chromium issue 499023054, and the Red Hat/SUSE tags indicate Chromium-derived downstream packages may inherit the fix.

RemediationAI

Vendor-released patch: update Google Chrome for Android to 147.0.7727.138 or later, the primary and complete fix; on Android this typically arrives via Google Play auto-update, so ensure devices can update and force it through MDM where managed. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the Chromium issue https://issues.chromium.org/issues/499023054. Because exploitation requires a prior renderer compromise, effective compensating controls until patching completes focus on reducing that first stage: keep Chrome fully updated so no renderer-level bugs remain, and for high-risk managed devices restrict browsing to trusted sites and limit autoplay/rich-media handling to shrink exposure of the Media code path - with the trade-off that media-heavy sites may render degraded. Given the patch is available, prioritize rolling the update rather than exotic mitigations.