What is the CVSS score of CVE-2026-7363?

CVE-2026-7363 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7363?

Google Chrome on Linux and ChromeOS running versions before 147.0.7727.138 is vulnerable to remote code execution when users visit malicious websites, potentially compromising credentials and…. A patch is available.

How to fix or mitigate CVE-2026-7363?

Within 24 hours, audit your organization to identify Linux and ChromeOS systems running Chrome and assess their exposure to internet-based threats. Within 7 days, deploy Google Chrome version 147.0.7727.138 or later across all affected systems through your standard browser update process, whether automatic updates, mobile device management, or manual distribution. Within 30 days, verify complete patch deployment through endpoint telemetry and system scans to confirm no systems remain running vulnerable Chrome versions.

Google Chrome CVE-2026-7363

HIGH

Use After Free (CWE-416)

2026-04-28 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) needing a victim visit (UI:R); scope unchanged as execution stays in the sandbox, with high C/I/A within the renderer.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:00 vuln.today

CVSS changed

Apr 29, 2026 - 13:23 NVD

8.8 (HIGH)

Patch released

Apr 29, 2026 - 00:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 22:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.

Technical ContextAI

The vulnerability lies in Chrome's Canvas implementation, part of the Blink rendering engine that draws 2D graphics for the HTML <canvas> element. The root cause is CWE-416 (Use After Free): the renderer keeps referencing a Canvas-related object after its memory has been freed, allowing attacker-controlled HTML/JavaScript to reclaim and manipulate that freed allocation to corrupt memory and hijack control flow. Because Canvas rendering is fully driven by untrusted web content, a single malicious page can reach the vulnerable code path. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome, and the description scopes impact to the Linux and ChromeOS builds. Importantly, resulting code execution is stated to occur inside the sandbox, so a full host compromise would require a separate sandbox-escape bug.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.138. Update Chrome to 147.0.7727.138 or later on Linux and ChromeOS via the Stable channel and restart the browser to load the fix, per Google's advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. On Red Hat and SUSE systems, apply the corresponding vendor Chrome/Chromium package update once published. Where immediate patching is not possible, reduce exposure by avoiding untrusted sites and enforcing strict site isolation and JavaScript restrictions on high-risk profiles; deploying enterprise policies to force auto-updates lowers the attack surface, at the cost of admin overhead. Because code execution is sandbox-contained, keeping the OS sandbox intact (never run Chrome with --no-sandbox) is a meaningful compensating control that preserves the barrier an attacker must still defeat.