What is the CVSS score of CVE-2026-7355?

CVE-2026-7355 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7355?

Google Chrome versions prior to 147.0.7727.138 contain a critical vulnerability enabling arbitrary code execution within the browser sandbox when users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-7355?

Within 24 hours, scan your environment for Chrome installations below version 147.0.7727.138 and issue an urgent patch notification to all affected users. Over the next 7 days, deploy Chrome 147.0.7727.138 or later through your endpoint management system (WSUS, MDM, or Chrome Enterprise policies) with restart enforcement. By day 30, verify at least 99% patch coverage through your asset management tools and enforce Chrome auto-updates organization-wide.

Google Chrome CVE-2026-7355

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Web-reachable UAF needs only a page visit (AV:N/AC:L/PR:N/UI:R); high renderer-process C/I/A with no scope change (S:U) since code stays inside the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:46 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.3 (HIGH) 8.8 (HIGH)

CVSS changed

Apr 29, 2026 - 13:23 NVD

7.3 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:36 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.

Technical ContextAI

The flaw lives in Chrome's Media subsystem, the component responsible for decoding and playing audio/video (e.g. HTML5 <video>/<audio>, MSE, WebCodecs pipelines). CWE-416 use-after-free means an object in the media stack is freed while a dangling pointer still references it; an attacker who controls media stream/element lifecycle from a web page can reallocate that freed memory with attacker-shaped data and then trigger a dereference to corrupt memory and hijack control flow. The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome desktop application across versions below the fixed build. Critically, the resulting code execution occurs within Chrome's multi-process sandbox, so absent a separate sandbox-escape bug the attacker is contained to the renderer process rather than the underlying OS.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later on all desktop platforms via the Stable Channel update (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html); most installs will receive this automatically, so verify the running build under chrome://settings/help and relaunch to complete the update, and push the update through enterprise management (GPO/MDM) for managed fleets. Chromium-based downstream products should apply the corresponding Red Hat and SUSE package updates once published. Where immediate patching is not possible, compensating controls include enabling Chrome's Site Isolation/strict sandbox (default) and, as a stronger stopgap, restricting or disabling untrusted media playback - trade-off: blocking or forcing click-to-play on <video>/<audio> and MSE content breaks legitimate streaming sites - plus web-filtering to limit browsing to trusted sites, which reduces but does not eliminate exposure since the bug triggers from any crafted page.