What is the CVSS score of CVE-2026-7353?

CVE-2026-7353 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7353?

Google's Chrome browser versions prior to 147.0.7727.138 contain a sandbox escape vulnerability in the Skia graphics library that enables privilege escalation for already-compromised renderer…. A patch is available.

How to fix or mitigate CVE-2026-7353?

Within 24 hours, audit your Chrome deployment scope to identify systems running versions prior to 147.0.7727.138. Within 7 days, deploy Chrome 147.0.7727.138 or later via your standard patch management process, prioritizing systems with elevated privileges or access to sensitive data. Within 30 days, verify 100% deployment success through device management telemetry or software inventory tools and confirm no vulnerable versions remain.

Google Chrome CVE-2026-7353

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-28 Chrome

Buffer Overflow Google Heap Overflow

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and precise heap grooming plus a visited crafted page (AC:H, UI:R); sandbox escape crosses a trust boundary (S:C) with total impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:54 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

8.3 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Chrome's Skia graphics library (versions prior to 147.0.7727.138) lets an attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, reported by Google's own Chrome team. Chromium rates it High severity and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is near zero (0.01%). SSVC records exploitation as none, meaning this is a defense-in-depth second-stage bug rather than a standalone entry point.

Technical ContextAI

Skia is the open-source 2D graphics rendering engine that Chromium uses to rasterize web content, canvas, and UI drawing; it processes untrusted geometry and image data from web pages. The flaw is CWE-122 (heap-based buffer overflow), where malformed drawing input causes a write beyond an allocated heap buffer, corrupting adjacent memory. Because Skia code runs across process boundaries in Chromium's multi-process architecture, a controlled overflow here can be leveraged to break out of the renderer sandbox into a more privileged context. The single affected CPE is cpe:2.3:a:google:chrome:*, and downstream tags indicate Red Hat and SUSE also ship affected Chromium-based packages.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on all desktop platforms, which is the primary and sufficient fix; verify via chrome://settings/help and relaunch to apply the update, since staged rollouts can leave older builds running. For Chromium-based distributions, apply the corresponding Red Hat and SUSE package updates as they become available. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. As a compensating control until patching completes, enforce Chrome auto-updates via enterprise policy and consider enabling the site isolation and renderer sandbox hardening that are default in Chrome; because exploitation requires a pre-compromised renderer, keeping the browser fully updated against renderer RCEs is the most effective adjacent mitigation - there is no feature to disable that specifically neutralizes a Skia overflow without breaking page rendering.