CVE-2026-7334
Published: 28 April 2026
Summary
CVE-2026-7334 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7334 is a use-after-free vulnerability (CWE-416) in the Views component of Google Chrome on macOS, affecting versions prior to 147.0.7727.138. It enables a remote attacker to potentially exploit heap corruption through a crafted HTML page. The Chromium security team rated it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, requiring no privileges. Successful exploitation could lead to arbitrary code execution, compromising confidentiality, integrity, and availability with high impact, such as full system control on the affected Mac.
Google addressed the issue in the stable channel update for desktop Chrome, as detailed in the release notes at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Users should update to version 147.0.7727.138 or later. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/496456528.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26159
Vulnerability details
Use after free in Views in Google Chrome on Mac prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free in Chrome's Views component is exploited via a crafted HTML page on a malicious website (drive-by compromise) leading to arbitrary code execution with full system control on macOS, enabling Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely patching of the use-after-free vulnerability in Chrome's Views component to version 147.0.7727.138 or later, directly eliminating the exploitable heap corruption.
Memory protection mechanisms such as ASLR, DEP, and hardened allocators directly mitigate use-after-free heap corruption exploits triggered by crafted HTML pages.
Process isolation via Chrome's renderer sandbox limits the impact of heap corruption in the Views component, preventing arbitrary code execution from compromising the entire system.