Cyber Resilience

CVE-2026-7350

High

Published: 28 April 2026

Published
28 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0024 14.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-7350 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-7350 is a use-after-free vulnerability (CWE-416) in the WebMIDI component of Google Chrome versions prior to 147.0.7727.138. It affects the Chromium-based browser's rendering engine, where improper memory management allows dangling pointers to be accessed after deallocation. The issue carries a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), classified as High severity by Chromium security standards.

A remote attacker who has already compromised the renderer process can exploit this vulnerability via a crafted HTML page to achieve a potential sandbox escape. Exploitation requires network access, high attack complexity, no user privileges, and user interaction (such as visiting a malicious site), but successful compromise elevates scope across the sandbox boundary, enabling high-impact confidentiality, integrity, and availability violations on the target system.

Mitigation is addressed in the stable channel update for Google Chrome desktop to version 147.0.7727.138, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/500018484. Security practitioners should prioritize updating affected Chrome installations to the patched version.

EU & UK References

Vulnerability details

Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The use-after-free in Chrome's renderer enables sandbox escape via crafted HTML page delivered over the web, directly mapping to drive-by compromise (T1189) and exploitation of client application vulnerabilities for code execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7357Same product: Apple Macos
CVE-2026-7342Same product: Apple Macos
CVE-2026-4680Same product: Apple Macos
CVE-2026-7355Same product: Apple Macos
CVE-2026-5284Same product: Apple Macos
CVE-2026-9992Same product: Apple Macos
CVE-2026-9118Same product: Apple Macos
CVE-2026-7336Same product: Apple Macos
CVE-2026-7974Same product: Apple Macos
CVE-2026-7352Same product: Apple Macos

Affected Assets

google
chrome
≤ 147.0.7727.138

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mandates timely patching of the use-after-free vulnerability in Chrome's WebMIDI component to eliminate the flaw.

prevent

Implements memory protection mechanisms that prevent unauthorized access to deallocated memory, directly mitigating use-after-free exploits.

prevent

Enforces process isolation via sandboxing to limit the impact of renderer process compromises and potential sandbox escapes.

References