CVE-2026-7349
Published: 28 April 2026
Summary
CVE-2026-7349 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in Chrome's Cast component by applying the vendor patch to version 147.0.7727.138 or later.
Provides memory protection mechanisms that mitigate exploitation of the use-after-free flaw by preventing unauthorized memory access and code execution.
Enforces boundary protections to restrict malicious network traffic from adjacent segments that could trigger the Cast component vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Cast component enables arbitrary code execution via adjacent network malicious traffic with no user interaction, directly matching exploitation of client application (web browser) for code execution.
NVD Description
Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-7349 is a use-after-free vulnerability (CWE-416) in the Cast component of Google Chrome versions prior to 147.0.7727.138. This flaw affects the browser's Cast functionality, which handles media casting over networks, and carries a CVSS v3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), classified as High severity by Chromium security standards.
An attacker on the local network segment (adjacent network access) can exploit this vulnerability by sending malicious network traffic to a targeted Chrome user. Successful exploitation allows arbitrary code execution inside the browser's sandbox, potentially leading to high confidentiality, integrity, and availability impacts without requiring user interaction or privileges.
Mitigation is addressed in the Chrome stable channel update announced on the Chrome Releases blog (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html) and detailed in the Chromium issue tracker (https://issues.chromium.org/issues/500034684). Users should update to Google Chrome 147.0.7727.138 or later to patch the vulnerability.
Details
- CWE(s)