CVE-2026-7359
Published: 28 April 2026
Summary
CVE-2026-7359 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7359 is a use-after-free vulnerability (CWE-416) in the ANGLE graphics component within Google Chrome versions prior to 147.0.7727.138. ANGLE serves as an implementation of OpenGL ES on Windows and other platforms, handling WebGL rendering in the browser's renderer process. The flaw, published on 2026-04-28, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
A remote attacker could exploit this vulnerability after compromising the renderer process, potentially achieving a sandbox escape through a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious site, but demands no privileges and has low complexity over a network vector. Successful sandbox escape could enable further compromise of the system, granting high impacts on confidentiality, integrity, and availability.
Chrome's stable channel update advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html details the patch in version 147.0.7727.138, recommending users update immediately to mitigate the issue. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/496284494.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26185
Vulnerability details
Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome renderer (WebGL/ANGLE) enables exploitation via crafted malicious HTML page requiring user visit, directly mapping to drive-by compromise for initial access and client application exploitation for code execution/sandbox escape.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, testing, and installation of software patches, directly mitigating the use-after-free vulnerability by applying the Chrome 147.0.7727.138 update.
Implements memory protections such as non-executable memory regions and process memory isolation, directly countering use-after-free exploits that attempt arbitrary code execution.
Enforces process isolation for the renderer sandbox, limiting the scope of compromise even if a use-after-free occurs, though the vulnerability enables escape.