CVE-2026-7348
Published: 28 April 2026
Summary
CVE-2026-7348 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely identification, reporting, and patching of the use-after-free flaw in Chrome's Codecs component.
Implements memory protection safeguards like DEP, ASLR, and stack canaries that comprehensively mitigate use-after-free exploitation for arbitrary code execution.
Enables proactive detection of vulnerable Chrome versions through vulnerability scanning, facilitating remediation before exploitation via crafted HTML pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome (client app) enables arbitrary code execution via crafted HTML page loaded by user, directly mapping to Exploitation for Client Execution.
NVD Description
Use after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-7348 is a use-after-free vulnerability (CWE-416) in the Codecs component of Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this vulnerability by tricking a user into loading a crafted HTML page in an affected browser instance. Successful exploitation enables arbitrary code execution confined within the browser's sandbox.
Google's stable channel update for desktop, announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html, addresses the issue in Chrome 147.0.7727.138 and later versions. Additional details are available in the Chromium bug tracker at https://issues.chromium.org/issues/500104917.
Details
- CWE(s)