CVE-2026-7350
Published: 28 April 2026
Summary
CVE-2026-7350 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7350 is a use-after-free vulnerability (CWE-416) in the WebMIDI component of Google Chrome versions prior to 147.0.7727.138. It affects the Chromium-based browser's rendering engine, where improper memory management allows dangling pointers to be accessed after deallocation. The issue carries a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), classified as High severity by Chromium security standards.
A remote attacker who has already compromised the renderer process can exploit this vulnerability via a crafted HTML page to achieve a potential sandbox escape. Exploitation requires network access, high attack complexity, no user privileges, and user interaction (such as visiting a malicious site), but successful compromise elevates scope across the sandbox boundary, enabling high-impact confidentiality, integrity, and availability violations on the target system.
Mitigation is addressed in the stable channel update for Google Chrome desktop to version 147.0.7727.138, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/500018484. Security practitioners should prioritize updating affected Chrome installations to the patched version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26176
Vulnerability details
Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free in Chrome's renderer enables sandbox escape via crafted HTML page delivered over the web, directly mapping to drive-by compromise (T1189) and exploitation of client application vulnerabilities for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely patching of the use-after-free vulnerability in Chrome's WebMIDI component to eliminate the flaw.
Implements memory protection mechanisms that prevent unauthorized access to deallocated memory, directly mitigating use-after-free exploits.
Enforces process isolation via sandboxing to limit the impact of renderer process compromises and potential sandbox escapes.