CVE-2026-7358
Published: 28 April 2026
Summary
CVE-2026-7358 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in Chrome's Animation component by requiring timely installation of the patch to version 147.0.7727.138 or later.
Implements memory protections to mitigate arbitrary code execution from the use-after-free flaw in the Animation component.
Vulnerability scanning identifies systems running vulnerable Chrome versions affected by CVE-2026-7358 for subsequent remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Animation component enables RCE via crafted HTML page requiring user visit, directly mapping to Drive-by Compromise (T1189) for initial access and Exploitation for Client Execution (T1203) for code execution.
NVD Description
Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-7358 is a use-after-free vulnerability (CWE-416) in the Animation component of Google Chrome prior to version 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this flaw via a crafted HTML page, leading to arbitrary code execution inside the Chrome sandbox. The attack requires low complexity and no privileges but depends on user interaction, such as visiting the malicious page over the network.
Mitigation is available through the Google Chrome stable channel update to version 147.0.7727.138 or later, as announced in the release blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Additional technical details are documented in the Chromium issue tracker at https://issues.chromium.org/issues/496285281.
Details
- CWE(s)