CVE-2026-7355
Published: 28 April 2026
Summary
CVE-2026-7355 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of known software flaws like this use-after-free vulnerability through patching to Chrome version 147.0.7727.138 or later.
Implements memory protection mechanisms such as ASLR, DEP, and CFI that comprehensively mitigate use-after-free vulnerabilities by preventing reliable exploitation.
Enforces process isolation through sandboxing to contain arbitrary code execution triggered by the media component use-after-free within isolated processes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free in Chrome's Media component is triggered by a crafted HTML page visited by the user, directly enabling Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203) to achieve arbitrary code execution.
NVD Description
Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Deeper analysisAI
CVE-2026-7355 is a use-after-free vulnerability (CWE-416) in the Media component of Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as Medium severity by Chromium security.
A remote attacker can exploit this vulnerability by crafting an HTML page that triggers the use-after-free condition in the Media component, enabling arbitrary code execution inside the browser's sandbox. Exploitation requires user interaction, such as visiting the malicious page, but needs no special privileges or authentication.
Mitigation is available through the Google Chrome stable channel update for desktop, which patches the issue in version 147.0.7727.138 and later. Details are provided in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html and the Chromium issue tracker at https://issues.chromium.org/issues/498285711. Security practitioners should advise users to update promptly.
Details
- CWE(s)