Cyber Resilience

CVE-2026-7342

High

Published: 28 April 2026

Published
28 April 2026
Modified
30 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0040 31.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-7342 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 31.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-7342 is a use-after-free vulnerability (CWE-416) in the WebView component of Google Chrome on Android prior to version 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.

A remote attacker can exploit this issue by crafting an HTML page that triggers the use-after-free condition when rendered in WebView. This requires user interaction, such as visiting a malicious site, and enables arbitrary code execution confined within the browser's sandbox.

Google addresses this vulnerability in Chrome for Android version 147.0.7727.138. Additional details on the patch and stable channel update are available in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the Chromium issue tracker at https://issues.chromium.org/issues/503889643.

EU & UK References

Vulnerability details

Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-416

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Use-after-free in browser WebView enables arbitrary code execution via crafted malicious webpage requiring user visit, directly mapping to drive-by compromise and client-side exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7357Same product: Apple Macos
CVE-2026-4680Same product: Apple Macos
CVE-2026-7355Same product: Apple Macos
CVE-2026-5284Same product: Apple Macos
CVE-2026-9992Same product: Apple Macos
CVE-2026-9118Same product: Apple Macos
CVE-2026-7336Same product: Apple Macos
CVE-2026-7974Same product: Apple Macos
CVE-2026-7352Same product: Apple Macos
CVE-2026-8521Same product: Apple Macos

Affected Assets

google
chrome
≤ 147.0.7727.138

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation through applying Chrome version 147.0.7727.138 directly eliminates the use-after-free vulnerability preventing sandboxed code execution.

SI-16 Memory Protection good match
prevent

Memory protection safeguards such as ASLR, DEP, and stack canaries directly mitigate use-after-free exploits by preventing unauthorized code execution from corrupted memory.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Vulnerability scanning identifies Android systems running vulnerable Chrome WebView versions prior to 147.0.7727.138 for targeted patching.

References