CVE-2026-7361
Published: 28 April 2026
Summary
CVE-2026-7361 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7361 is a use-after-free vulnerability (CWE-416) affecting the iOS version of Google Chrome prior to 147.0.7727.138. The flaw resides in the browser's handling of memory, enabling potential heap corruption when processing a crafted HTML page. Chromium security rated it as Critical, assigning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), highlighting its network accessibility, low attack complexity, and high potential impacts.
A remote attacker can exploit this vulnerability by luring a user to visit a malicious website with a specially crafted HTML page, requiring user interaction such as clicking or rendering the page. No special privileges are needed. Successful exploitation could allow the attacker to achieve heap corruption, potentially leading to arbitrary code execution, data theft, or system compromise with high confidentiality, integrity, and availability impacts.
Mitigation is available via an update to Google Chrome 147.0.7727.138 or later, as announced in the stable channel update on the Chrome Releases blog (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html). Additional technical details and the upstream fix are tracked in the Chromium issue at https://issues.chromium.org/issues/493221953. Security practitioners should prioritize updating affected iOS Chrome installations and advise users to enable automatic updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26187
Vulnerability details
Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free vulnerability enables remote arbitrary code execution via a crafted HTML page on a malicious website, directly mapping to Drive-by Compromise (T1189) for the attack delivery vector and Exploitation for Client Execution (T1203) for leveraging the client-side browser flaw to run malicious code.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the use-after-free vulnerability through application of the Chrome 147.0.7727.138 patch.
Facilitates scanning and identification of iOS Chrome installations vulnerable to CVE-2026-7361 prior to exploitation.
Provides memory protection mechanisms like ASLR to minimize successful heap corruption from crafted HTML exploiting the use-after-free flaw.