CVE-2026-7341
Published: 28 April 2026
Summary
CVE-2026-7341 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly addresses the use-after-free vulnerability by applying the Chrome patch to version 147.0.7727.138.
Memory protection techniques like DEP and ASLR prevent arbitrary code execution from the WebRTC use-after-free memory corruption.
Process isolation via browser sandboxing confines the arbitrary code execution from the vulnerability to a restricted execution domain.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome WebRTC enables arbitrary code execution via crafted HTML page requiring user interaction, directly mapping to Drive-by Compromise (T1189) for initial access and Exploitation for Client Execution (T1203) in browser client.
NVD Description
Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-7341 is a use-after-free vulnerability (CWE-416) in the WebRTC component of Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this vulnerability via a crafted HTML page, achieving arbitrary code execution inside the browser's sandbox. Exploitation requires user interaction, such as loading the malicious page, but needs no privileges and has low attack complexity over the network.
Google mitigated the issue in the stable channel update to Chrome 147.0.7727.138, as detailed in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the Chromium issue tracker at https://issues.chromium.org/issues/504586599.
Details
- CWE(s)