Cyber Posture

CVE-2026-7347

High

Published: 28 April 2026

Published
28 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7347 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely patching of the use-after-free flaw in Chrome's Chromoting component, as fixed in version 147.0.7727.138.

prevent

Implements memory safeguards like ASLR and DEP that mitigate exploitation of use-after-free vulnerabilities via crafted network traffic.

detect

Enables vulnerability scanning to identify systems running vulnerable Chrome versions prior to 147.0.7727.138.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in Chrome client component enables remote arbitrary code execution via crafted network traffic with no user interaction, directly mapping to T1203 Exploitation for Client Execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-7347 is a use-after-free vulnerability (CWE-416) in the Chromoting component of Google Chrome prior to version 147.0.7727.138. It allows a remote attacker to potentially execute arbitrary code through malicious network traffic. The vulnerability carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with high attack complexity but no privileges or user interaction required.

A remote attacker can exploit this vulnerability by sending crafted network traffic to a targeted Chrome user, leading to arbitrary code execution on the victim's system. The high confidentiality, integrity, and availability impacts enable full system compromise if successfully exploited, though the high attack complexity may limit feasibility for less sophisticated adversaries.

Mitigation is addressed in Google Chrome version 147.0.7727.138 and later, as detailed in the stable channel update for desktop released on the Chrome Releases blog. Additional technical details are available in the corresponding Chromium issue tracker entry. Security practitioners should ensure users update to the patched version promptly.

Details

CWE(s)

Affected Products

google
chrome
≤ 147.0.7727.138

CVEs Like This One

CVE-2026-5860Same product: Apple Macos
CVE-2026-7349Same product: Apple Macos
CVE-2026-3923Same product: Apple Macos
CVE-2025-11756Same product: Apple Macos
CVE-2026-3921Same product: Apple Macos
CVE-2025-8578Same product: Apple Macos
CVE-2026-7338Same product: Apple Macos
CVE-2026-6316Same product: Apple Macos
CVE-2026-2321Same product: Apple Macos
CVE-2026-3919Same product: Apple Macos

References