CVE-2026-7344: Google Chrome Use After Free Vulnerability

CVE-2026-7344 Overview

CVE-2026-7344 is a use-after-free vulnerability in the Accessibility component of Google Chrome on Windows prior to version 147.0.7727.138. The flaw [CWE-416] allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Google's Chromium project assigned this issue a security severity of Critical. Successful exploitation chains this bug with a prior renderer compromise to break out of the sandboxed process and execute code in a higher-privileged browser context.

Critical Impact
Attackers chaining a renderer compromise with CVE-2026-7344 can escape the Chrome sandbox and achieve code execution in the broker process via a crafted HTML page.

Affected Products

Google Chrome on Windows prior to 147.0.7727.138
Google Chrome on Apple macOS prior to 147.0.7727.138
Google Chrome on Linux prior to 147.0.7727.138

Discovery Timeline

2026-04-28 - CVE-2026-7344 published to NVD following Google's Stable Channel update
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7344

Vulnerability Analysis

The vulnerability resides in Chrome's Accessibility subsystem, which exposes structural information about page content to assistive technologies. Accessibility code maintains a tree of nodes that mirrors the DOM and propagates events across process boundaries. A use-after-free condition occurs when this code references an accessibility object after its backing memory has been released.

Use-after-free bugs in Chrome's Accessibility layer are particularly dangerous because the component spans both the renderer and the browser process. The attacker model assumes the renderer is already compromised, meaning the adversary controls inputs flowing into the accessibility IPC channel. By manipulating object lifetimes through carefully timed events, the attacker reclaims freed memory and influences control flow inside a privileged process.

Root Cause

The root cause is improper lifetime management of accessibility objects [CWE-416]. A code path retains a raw pointer or reference to an accessibility node that another path has destroyed. When the dangling reference is later dereferenced, the freed slot may already hold attacker-controlled data, producing memory corruption.

Attack Vector

Exploitation requires the attacker to first compromise the renderer process, typically through a separate memory-safety bug exposed by a malicious web page. The attacker then triggers the accessibility code path with a crafted sequence of DOM mutations and accessibility events delivered through IPC. User interaction is required, consistent with the CVSS vector indicating a network-based attack with user interaction. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-7344

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Crash reports referencing the Accessibility component or content::BrowserAccessibility frames
Outbound connections from chrome.exe to untrusted domains immediately after rendering attacker-controlled HTML

Detection Strategies

Monitor endpoints for Chrome versions below 147.0.7727.138 using software inventory tooling
Hunt for renderer process anomalies including unexpected memory allocations, handle inheritance, or token manipulation by chrome.exe
Correlate browser crash telemetry with web traffic to identify exploitation attempts originating from specific domains

Monitoring Recommendations

Forward Chrome crash dumps and Windows Error Reporting events to a central data lake for retrospective hunting
Enable EDR process-tree visibility on browser binaries and alert on sandbox escape patterns such as chrome.exe writing to protected paths
Track DNS and HTTP telemetry for navigation events preceding browser crashes to identify exploit delivery infrastructure

How to Mitigate CVE-2026-7344

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after deployment to ensure the patched binary loads; verify the running version via chrome://version
Audit managed extensions and remove any that inject content into untrusted pages and could amplify renderer exposure

Patch Information

Google released the fix in the Stable Channel update announced on April 28, 2026. Deploy Chrome 147.0.7727.138 or later as documented in the Google Chrome Update Announcement. Enterprise administrators should use Chrome Browser Cloud Management or existing software deployment tooling to enforce the minimum version.

Workarounds

Restrict browsing of untrusted sites until patching completes, using URL allowlists in enterprise policy
Enable Chrome's Site Isolation and Enhanced Safe Browsing through SitePerProcess and SafeBrowsingProtectionLevel policies
Apply the ExtensionInstallBlocklist policy to reduce the renderer attack surface from third-party code

bash

# Configuration example: enforce minimum Chrome version via Windows Group Policy registry keys
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "147.0.7727.138" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v SitePerProcess /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v SafeBrowsingProtectionLevel /t REG_DWORD /d 2 /f