What is the CVSS score of CVE-2026-7359?

CVE-2026-7359 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7359?

Google Chrome versions prior to 147.0.7727.138 contain a use-after-free vulnerability in the ANGLE graphics layer that allows an attacker with control of the renderer process to escape the browser…. A patch is available.

How to fix or mitigate CVE-2026-7359?

Within 24 hours, audit Chrome deployment across the organization to identify affected versions and create a patching timeline. Within 7 days, begin rolling out Chrome 147.0.7727.138 or later through your endpoint management system, testing for compatibility with business-critical web applications and extensions. Within 30 days, complete deployment to 100% of Chrome installations and verify version compliance through your security tools.

Google Chrome CVE-2026-7359

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H because exploitation is a chained second stage requiring a pre-compromised renderer; UI:R for the crafted page; high C/I/A reflect total impact of a sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:56 vuln.today

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform library that translates OpenGL ES/WebGL calls onto native backends such as Direct3D, Metal, or Vulkan; it processes attacker-influenceable graphics commands originating from web content. The flaw is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent reuse of that stale pointer lets an attacker corrupt memory in the more-privileged process boundary that ANGLE straddles (GPU/graphics handling versus the sandboxed renderer). Because ANGLE code paths sit outside the renderer sandbox, corrupting them from a controlled renderer is a classic sandbox-escape primitive. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and the same code is redistributed downstream, reflected by the Red Hat and SUSE tags for Chromium-based packages.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later via the Stable channel and restart the browser to load the fix (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html). For managed fleets, push the update through your enterprise management/auto-update policy and verify the running version. Users of Chromium-based downstream builds (Red Hat, SUSE, and other rebranded browsers) should apply their vendor's corresponding updated package once available. No standalone workaround fully removes the defect; if patching must be delayed, reduce exposure by restricting untrusted web browsing, and note that Chrome's site isolation and sandbox already raise the bar since exploitation additionally requires a prior renderer compromise - disabling GPU/WebGL acceleration may reduce ANGLE attack surface at the cost of degraded rendering performance and is not a guaranteed mitigation.