CVE-2026-7335
Published: 28 April 2026
Summary
CVE-2026-7335 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7335 is a use-after-free vulnerability (CWE-416) in the media component of Google Chrome versions prior to 147.0.7727.138. This flaw affects the Chromium-based browser and was published on 2026-04-28 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), classified as high severity by Chromium security standards.
A remote attacker can exploit this vulnerability by tricking a user into visiting a crafted HTML page, leading to arbitrary code execution inside the browser's sandbox. The attack requires no privileges and low complexity but depends on user interaction, with high impacts on confidentiality, integrity, and availability within the sandboxed environment.
Mitigation is addressed in the Google Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html, which patches the issue in version 147.0.7727.138 and later. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/500387779. Security practitioners should advise users to update to the latest stable version promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26161
Vulnerability details
Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome media component enables RCE via crafted HTML page visit, directly mapping to Drive-by Compromise (T1189) for delivery and Exploitation for Client Execution (T1203) for browser code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of flaws, directly addressing the use-after-free vulnerability in Google Chrome's media component through patching to version 147.0.7727.138 or later.
Implements memory protection safeguards such as DEP and ASLR to prevent arbitrary code execution from use-after-free memory corruption in the browser's media processing.
Enforces process isolation to contain code execution within the browser sandbox, limiting the impact of the exploit even if memory corruption occurs.