What is the CVSS score of CVE-2026-7361?

CVE-2026-7361 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7361?

Google Chrome for iOS versions before 147.0.7727.138 contain a heap corruption vulnerability enabling remote code execution when users open malicious web content.. A patch is available.

How to fix or mitigate CVE-2026-7361?

Within 24 hours, communicate to all iOS users the availability and urgency of Chrome update 147.0.7727.138; flag this as a critical security update requiring immediate action. Within 7 days, deploy version 147.0.7727.138 to all managed iOS devices through your MDM platform or push notifications; prioritize devices with access to sensitive systems. Within 30 days, audit device inventory to confirm patch deployment across 100% of Chrome iOS installations and configure ongoing vulnerability scanning to detect any exploitation attempts targeting Chrome.

Google Chrome CVE-2026-7361

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

Denial Of Service Google Use After Free Memory Corruption Apple

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery with no privileges but required user interaction (UI:R); a use-after-free enabling potential code execution yields high C/I/A within the browser process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:59 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).

Technical ContextAI

The vulnerability is a use-after-free (CWE-416), a memory-corruption class where a pointer to freed heap memory is subsequently dereferenced or reused, letting an attacker groom the heap to control the freed object and corrupt adjacent structures. It affects Google Chrome (CPE cpe:2.3:a:google:chrome), triggered through rendering/processing of a crafted HTML page - consistent with a bug in the browser's page-processing pipeline. Note the description specifies the iOS build of Chrome; the upstream tracking issue (issues.chromium.org/493221953) and the Chrome stable-channel release notes are the authoritative technical references.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.138 or later, per the Chrome stable-channel advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html). Because Chrome auto-updates, the primary action is to force a relaunch so the update applies, and to verify enterprise-managed fleets have received the build; users on the iOS build should update via the App Store. If patching cannot be completed immediately, reduce exposure by having users avoid untrusted links and by enforcing browser update policies (managed-update GPO/MDM), and consider Chrome's Site Isolation and enhanced-safe-browsing settings - the trade-off being these mitigate but do not eliminate a heap use-after-free triggered by crafted HTML.