CVE-2026-7363
Published: 28 April 2026
Summary
CVE-2026-7363 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely identification, reporting, and remediation of the use-after-free flaw in Chrome Canvas via patching to version 147.0.7727.138 or later.
Implements memory protection techniques like ASLR, DEP, and stack canaries that mitigate exploitation of the use-after-free vulnerability by randomizing addresses and restricting executable memory.
Enforces process isolation through browser sandboxing, confining arbitrary code execution from the Canvas use-after-free to a limited execution domain and preventing broader system compromise.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Canvas enables RCE via crafted HTML page visit, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).
NVD Description
Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
Deeper analysisAI
CVE-2026-7363 is a use-after-free vulnerability (CWE-416) in the Canvas component of Google Chrome on Linux and ChromeOS, affecting versions prior to 147.0.7727.138. Published on 2026-04-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as Critical severity by Chromium security.
A remote attacker can exploit this vulnerability by tricking a user into visiting a crafted HTML page, with no privileges required but user interaction needed. Successful exploitation enables arbitrary code execution inside the browser's sandbox.
Mitigation is available via the stable channel update for desktop, as announced in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Additional details are provided in Chromium issue tracker entry 494352590 at https://issues.chromium.org/issues/494352590. Affected users should update to Google Chrome version 147.0.7727.138 or later.
Details
- CWE(s)