CVE-2026-7347
Published: 28 April 2026
Summary
CVE-2026-7347 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 27.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-7347 is a use-after-free vulnerability (CWE-416) in the Chromoting component of Google Chrome prior to version 147.0.7727.138. It allows a remote attacker to potentially execute arbitrary code through malicious network traffic. The vulnerability carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with high attack complexity but no privileges or user interaction required.
A remote attacker can exploit this vulnerability by sending crafted network traffic to a targeted Chrome user, leading to arbitrary code execution on the victim's system. The high confidentiality, integrity, and availability impacts enable full system compromise if successfully exploited, though the high attack complexity may limit feasibility for less sophisticated adversaries.
Mitigation is addressed in Google Chrome version 147.0.7727.138 and later, as detailed in the stable channel update for desktop released on the Chrome Releases blog. Additional technical details are available in the corresponding Chromium issue tracker entry. Security practitioners should ensure users update to the patched version promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26173
Vulnerability details
Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome client component enables remote arbitrary code execution via crafted network traffic with no user interaction, directly mapping to T1203 Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the use-after-free flaw in Chrome's Chromoting component, as fixed in version 147.0.7727.138.
Implements memory safeguards like ASLR and DEP that mitigate exploitation of use-after-free vulnerabilities via crafted network traffic.
Enables vulnerability scanning to identify systems running vulnerable Chrome versions prior to 147.0.7727.138.