CVE-2026-7339
Published: 28 April 2026
Summary
CVE-2026-7339 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-7339 is a heap buffer overflow vulnerability, classified under CWE-122, affecting the WebRTC component in Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it enables a remote attacker to potentially exploit heap corruption by means of a crafted HTML page. The Chromium security team assesses this as Medium severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability over the network with low complexity by luring a user to interact with a malicious site hosting the crafted HTML page. Successful exploitation may result in high-impact corruption of the heap, potentially allowing arbitrary code execution and compromising confidentiality, integrity, and availability of the affected browser instance.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.138 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the corresponding Chromium issue at https://issues.chromium.org/issues/493957495. Security practitioners should prioritize updating affected Chrome installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26165
Vulnerability details
Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome WebRTC enables remote arbitrary code execution via crafted HTML page on malicious site, directly mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of software flaws like this heap buffer overflow in Chrome's WebRTC, preventing exploitation via crafted HTML pages.
Implements memory protections such as ASLR, DEP, and heap canaries that mitigate successful exploitation of heap buffer overflows leading to corruption.
Enables scanning and monitoring to identify systems running vulnerable Chrome versions affected by this WebRTC heap buffer overflow.