CVE-2026-7338
Published: 28 April 2026
Summary
CVE-2026-7338 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely patching of the use-after-free vulnerability in Chrome's Cast component to version 147.0.7727.138 or later.
Enforces network boundary protections to restrict malicious traffic from the local network segment necessary for exploitation.
Implements memory safeguards such as ASLR and DEP to mitigate heap corruption from use-after-free exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free vulnerability in Chrome's Cast component enables remote code execution via malicious adjacent network traffic with no user interaction required, directly mapping to exploitation of a client application vulnerability.
NVD Description
Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-7338 is a use-after-free vulnerability (CWE-416) in the Cast component of Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it enables potential heap corruption and carries a Chromium security severity rating of High, with a CVSS v3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
An attacker positioned on the local network segment can exploit this vulnerability through malicious network traffic. No privileges or user interaction are required, though the attack involves high complexity. Successful exploitation could result in high impacts to confidentiality, integrity, and availability.
Mitigation is available via the stable channel update for desktop Chrome, as announced in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html, which promotes version 147.0.7727.138. Additional details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/502449857. Security practitioners should ensure systems update to the patched version or later.
Details
- CWE(s)