What is the CVSS score of CVE-2026-7354?

CVE-2026-7354 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7354?

Google Chrome contains a critical vulnerability (CVSS 8.8) in versions before 147.0.7727.138 that allows unauthenticated attackers to escape the browser sandbox through malicious websites and…. A patch is available.

How to fix or mitigate CVE-2026-7354?

Within 24 hours, distribute urgent notification to all Chrome users and IT teams to update Google Chrome to version 147.0.7727.138 or later; classify this as a critical security update and prioritize immediate deployment. Within 7 days, verify patch deployment across all managed endpoints using endpoint management tools and remediate any non-compliant systems. By day 30, confirm 100% patching rate organization-wide and review Chrome auto-update policies to ensure critical patches are deployed without delay.

Google Chrome CVE-2026-7354

HIGH

Out-of-bounds Read (CWE-125)

2026-04-28 Chrome

Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page, no auth (PR:N) but requires visiting it (UI:R); GPU-process memory corruption yields high C/I/A, scope unchanged since the escape is only potential.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:54 vuln.today

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read/write in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page corrupt GPU-process memory and potentially escape the browser sandbox, on all Chrome builds before 147.0.7727.138. Rated High by Chromium with CVSS 8.8; a vendor patch is available and no public exploit identified at time of analysis. EPSS is very low (0.01%) and SSVC records exploitation status 'none', so risk is currently theoretical despite the total technical impact.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction layer that translates OpenGL ES / WebGL calls into the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). It runs inside Chrome's GPU process and is reachable from untrusted web content through WebGL/WebGPU, making it a long-standing browser attack surface. The root cause is CWE-125 (out-of-bounds read) combined with an out-of-bounds write, meaning ANGLE mishandles buffer/array bounds while processing attacker-controlled rendering commands, allowing memory disclosure and corruption in the GPU process - a step toward the sandbox escape the advisory describes.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the stable channel, and on managed fleets force a browser relaunch so the update actually applies (per https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html). Users of Chromium-based or distro-packaged builds (Red Hat, SUSE) should apply the corresponding vendor update once it ships the fixed ANGLE. As an interim compensating control where patching is delayed, ANGLE is reached primarily through hardware-accelerated WebGL/WebGPU, so disabling GPU acceleration (chrome://settings 'Use graphics acceleration when available' off, or --disable-gpu / policy HardwareAccelerationModeEnabled=false) reduces exposure, with the trade-off of degraded rendering performance and broken WebGL/WebGPU content. Restricting browsing to trusted sites via policy further limits the crafted-page delivery vector.