What is the CVSS score of CVE-2026-7357?

CVE-2026-7357 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7357?

Google Chrome versions before 147.0.7727.138 contain a heap corruption vulnerability in the GPU component that enables privilege escalation within an already-compromised renderer process.. A patch is available.

How to fix or mitigate CVE-2026-7357?

Within 24 hours, inventory Chrome installations across enterprise endpoints and identify systems handling sensitive data or running with elevated privileges. Within 7 days, initiate staged rollout of Chrome version 147.0.7727.138 or later, beginning with test systems and high-risk workstations. Complete deployment to all Chrome instances within 30 days; enable automatic Chrome updates in enterprise policy to prevent future version drift and reduce manual patching cycles.

Google Chrome CVE-2026-7357

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires prior renderer compromise (modeled as PR:L) and complex heap grooming (AC:H) via a crafted page (UI:R); crossing the sandbox into the GPU process is a scope change (S:C) with high C/I/A.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:55 vuln.today

CVSS changed

Apr 29, 2026 - 21:22 NVD

8.8 (HIGH) 7.5 (HIGH)

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's GPU process, the component responsible for compositing and hardware-accelerated rendering (GPU acceleration, WebGL/WebGPU, canvas). A dangling pointer to freed GPU-related heap memory can be reclaimed and reused, producing heap corruption that a skilled attacker may steer toward controlled memory writes. The single CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop builds prior to the fixed release. Because Chrome isolates web content in a sandboxed renderer, the GPU process sits across a separate process boundary; a UAF here is typically valuable as a sandbox-escape building block rather than an initial-access primitive, which is why the description explicitly conditions exploitation on the renderer already being compromised.

RemediationAI

Vendor-released patch: 147.0.7727.138 - update Google Chrome to that build or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html) and restart the browser to apply. Enterprises using Red Hat or SUSE Chromium packages should pull the corresponding distributor updates once published. As an interim compensating control before patching, GPU-side attack surface can be reduced by disabling hardware acceleration (chrome://settings 'Use graphics acceleration when available' off, or the --disable-gpu flag), which lowers exposure of the vulnerable GPU code paths at the cost of degraded rendering/video performance and higher CPU use; this is only partial mitigation. Enforcing automatic Chrome updates via policy is the durable fix.