What is the CVSS score of CVE-2026-7358?

CVE-2026-7358 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7358?

Google Chrome desktop versions before 147.0.7727.138 contain a remote code execution vulnerability (CVE-2026-7358, CVSS 8.8) exploitable when users visit a crafted webpage, affecting all employees…. A patch is available.

How to fix or mitigate CVE-2026-7358?

Within 24 hours, inventory all Google Chrome desktop installations across the organization and prioritize security-sensitive systems. Within 7 days, deploy Chrome version 147.0.7727.138 or later through your software management solution (Windows Update, Group Policy, MDM, or equivalent) and validate installation on at least 80% of endpoints. Within 30 days, achieve 100% compliance on the final 20% of systems and establish a process to deploy future Chrome security patches within 7 days of vendor release.

Google Chrome CVE-2026-7358

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the user to visit it (UI:R); memory corruption yields full renderer C/I/A impact with sandbox-contained, unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:56 vuln.today

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.

Technical ContextAI

The flaw lives in Chrome's Animation subsystem, part of the Blink rendering engine that drives CSS/Web Animations timeline and effect objects. CWE-416 (use-after-free) means an object backing an animation is freed while a dangling reference is still reachable, so subsequent manipulation of that freed memory lets an attacker corrupt heap state and hijack control flow. Because rendering of untrusted web content occurs in the sandboxed renderer process, the description explicitly notes code execution occurs 'inside a sandbox' - meaning a further sandbox-escape bug would be needed to reach the host OS. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the Chrome application (desktop, per the Stable Channel desktop advisory) is the affected surface.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Stable channel, then relaunch the browser to apply the fix (Help > About Google Chrome triggers the update check); details are in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Managed fleets should push the updated build through enterprise policy/MDM and confirm the running version. For downstream Chromium packages, apply the Red Hat and SUSE security updates as they ship. If immediate patching is not possible, compensating controls include restricting browsing of untrusted sites, deploying URL filtering/web proxy blocking of unknown domains to reduce the chance of loading a malicious page, and keeping the renderer sandbox enabled (do not launch Chrome with --no-sandbox), since the exploit is described as executing only inside the sandbox - with the trade-off that these controls reduce but do not eliminate exposure and can impact user browsing workflows.