What is the CVSS score of CVE-2026-7360?

CVE-2026-7360 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7360?

Yes, a patch is available for CVE-2026-7360. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7360

LOW

Improper Input Validation (CWE-20)

2026-04-28 Chrome

Authentication Bypass Google

3.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.4 LOW

S:C reassessed from S:U because site isolation bypass definitionally crosses a security scope boundary; all other metrics follow CVSS input data.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:58 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

3.1 (LOW)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

LOW 3.1

DescriptionCVE.org

Insufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome's Compositing component (versions prior to 147.0.7727.138) enables a remote attacker who has already achieved renderer process compromise to escape the cross-origin security boundary via a crafted HTML page. This is a second-stage attack primitive - it does not stand alone but extends an existing renderer exploit into a partial policy bypass, potentially leaking cross-origin content. No public exploit code has been identified and EPSS is extremely low at 0.02%, yet Chromium's internal rating of High reflects the strategic value of site isolation escapes in chained browser exploit scenarios.

Technical ContextAI

The Compositing component in Chrome is responsible for rendering and layering visual content from multiple web origins. Chrome's Site Isolation architecture enforces strict process-level separation between content from different origins (sites), making it a core security boundary against cross-origin data theft. CWE-20 (Improper Input Validation) indicates that the Compositing layer fails to adequately validate attacker-controlled data when the rendering process has been compromised, allowing the crafted input to influence compositing decisions in a way that crosses the site isolation boundary. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 147.0.7727.138 on supported platforms. This class of vulnerability is significant not in isolation but as a link in a multi-stage browser exploit chain.

RemediationAI

Update Google Chrome to version 147.0.7727.138 or later, which is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Chrome's auto-update mechanism will deliver this in most managed and consumer environments; administrators should verify forced-update policies are active. As a compensating control where immediate upgrade is not possible, enforcing Site Isolation via enterprise policy (SitePerProcess) does not mitigate this flaw (it is already a bypass of that control), but restricting access to untrusted web content via URL filtering or disabling JavaScript for non-essential browsing can reduce attack surface. No workaround fully substitutes for the patch given the compositing-layer nature of the flaw.