What is the CVSS score of CVE-2026-7356?

CVE-2026-7356 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7356?

Google Chrome versions prior to 147.0.7727.138 contain a use-after-free vulnerability in the Navigation component that permits arbitrary code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-7356?

Within 24 hours: communicate patch availability (Chrome 147.0.7727.138 or later) to all Chrome users and verify auto-update is enabled in your environment. Within 7 days: validate that at least 95% of Chrome installations across the organization have been updated to version 147.0.7727.138 or later using your standard patch management reporting. Within 30 days: conduct a full inventory sweep to confirm zero instances of Chrome prior to 147.0.7727.138 remain in production, and configure vulnerability scanning to detect any regressions to older versions.

Google Chrome CVE-2026-7356

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page requires user navigation (UI:R) but no auth (PR:N); low-complexity UAF yielding full renderer code execution gives high C/I/A, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:55 vuln.today

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's Navigation subsystem, the code path that manages document loads, session history, and navigation lifecycle inside the Blink/content layer. Use-after-free bugs occur when an object is freed while a pointer to it is still held and later dereferenced; in a browser's navigation logic these are frequently triggered by JavaScript-driven navigation, reentrancy, or object lifetime races provoked by attacker-controlled page content. Successful exploitation typically grants control over freed heap memory, enabling attacker-controlled data to be treated as a live object and steered toward code execution. The affected component is identified in CPE data as cpe:2.3:a:google:chrome (all versions prior to the fixed build), and the class of bug is the most common source of critical Chrome renderer vulnerabilities.

RemediationAI

Vendor-released patch: 147.0.7727.138 - update Google Chrome to 147.0.7727.138 or later via the Chrome Stable channel and restart the browser to apply the fix (Help > About Google Chrome forces the check), per the advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Users of Chromium-based downstream builds should apply the corresponding Red Hat or SUSE package updates once published. Because exploitation requires rendering a malicious page, interim compensating controls include restricting browsing to trusted sites and enabling enterprise policies that gate untrusted content; note these controls reduce but do not eliminate exposure and can disrupt legitimate workflows, so they are stopgaps until the patched build is deployed. No feature-level disable is available since the flaw is in core navigation, making the browser update the only complete remediation.