CVE-2026-7343
Published: 28 April 2026
Summary
CVE-2026-7343 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-7343 is a use-after-free vulnerability (CWE-416) in the Views component of Google Chrome on Windows, affecting versions prior to 147.0.7727.138. Published on 2026-04-28, this critical Chromium security issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker who has already compromised the renderer process can exploit the vulnerability via a crafted HTML page to potentially achieve a sandbox escape. The attack vector requires network access with high complexity, no privileges, and user interaction, leading to high impacts on confidentiality, integrity, and availability within unchanged scope.
Mitigation is available in Google Chrome version 147.0.7727.138 and later. Advisories detail the patch in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the associated Chromium issue at https://issues.chromium.org/issues/503645680.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26169
Vulnerability details
Use after free in Views in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome renderer enables sandbox escape after initial renderer compromise, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of flaws, directly addressing the use-after-free vulnerability patched in Chrome version 147.0.7727.138.
Implements memory protection mechanisms that mitigate exploitation of use-after-free errors in the renderer process.
Enforces process isolation to limit the impact of sandbox escapes from a compromised renderer process.