CVE-2026-7347: Google Chrome Use-After-Free Vulnerability

CVE-2026-7347 Overview

A use-after-free vulnerability has been identified in the Chromoting component of Google Chrome prior to version 147.0.7727.138. This memory corruption flaw allows remote attackers to potentially execute arbitrary code by sending specially crafted malicious network traffic to the target system. The vulnerability stems from improper memory management within Chrome's remote desktop functionality.

Critical Impact
Remote attackers can exploit this use-after-free vulnerability via malicious network traffic to achieve arbitrary code execution without requiring user interaction or authentication.

Affected Products

Google Chrome prior to version 147.0.7727.138
Chromium-based browsers using vulnerable Chromoting component
Chrome Remote Desktop implementations using affected Chrome versions

Discovery Timeline

2026-04-28 - CVE CVE-2026-7347 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7347

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption vulnerability that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of Chromoting, Chrome's remote desktop protocol implementation, this flaw creates a dangerous condition where freed memory regions can be accessed and manipulated.

The network-accessible nature of this vulnerability is particularly concerning because Chromoting handles remote desktop connections. When processing malicious network traffic, the vulnerable code path can trigger use of deallocated memory structures, potentially allowing an attacker to corrupt heap metadata or hijack program control flow.

While exploitation requires high attack complexity due to the nature of use-after-free vulnerabilities (which typically need precise heap manipulation and timing), successful exploitation could lead to full compromise of confidentiality, integrity, and availability on the target system.

Root Cause

The root cause is improper lifecycle management of memory objects within the Chromoting subsystem. When handling certain network protocol messages, the code fails to properly track object references, leading to a scenario where memory is freed while still being referenced by other parts of the code. Subsequent access to this freed memory constitutes the use-after-free condition.

Attack Vector

The attack vector is network-based, targeting the Chromoting remote desktop functionality. An attacker would need to send specially crafted network packets to a vulnerable Chrome instance with Chromoting enabled. The malicious traffic would trigger the use-after-free condition during protocol processing, potentially allowing the attacker to:

Corrupt heap memory structures
Overwrite freed memory with attacker-controlled data
Achieve arbitrary code execution when the freed memory is subsequently accessed

Due to the high complexity required for reliable exploitation (heap grooming, bypassing exploit mitigations), this attack would likely require sophisticated techniques. For detailed technical information, refer to the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-7347

Indicators of Compromise

Unusual or malformed Chromoting protocol traffic on network monitoring systems
Chrome browser crashes or unexpected terminations during remote desktop sessions
Memory access violation errors in Chrome crash reports referencing Chromoting components
Abnormal heap allocation patterns in Chrome process memory

Detection Strategies

Monitor for Chrome versions prior to 147.0.7727.138 across the enterprise environment
Implement network intrusion detection signatures for anomalous Chromoting protocol traffic
Review endpoint detection logs for Chrome Remote Desktop process anomalies
Deploy application whitelisting to ensure only patched Chrome versions are permitted

Monitoring Recommendations

Enable verbose logging for Chrome Remote Desktop connections in enterprise environments
Configure SIEM rules to alert on multiple Chrome crashes from the same endpoint
Monitor for unusual outbound connections from Chrome processes post-crash events
Implement network segmentation monitoring for Chromoting traffic patterns

How to Mitigate CVE-2026-7347

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later immediately across all systems
Disable Chrome Remote Desktop (Chromoting) on systems where it is not required
Review and restrict network access to Chromoting services using firewall rules
Monitor for exploitation attempts while patch deployment is in progress

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 147.0.7727.138. Organizations should prioritize updating all Chrome installations to this version or later. For official patch details, refer to the Google Chrome Update Blog Post.

The update addresses the memory management issue in Chromoting that allowed the use-after-free condition to occur. Chrome's automatic update mechanism should deploy this fix; however, enterprise environments with managed Chrome deployments should verify updates are properly distributed.

Workarounds

Disable Chrome Remote Desktop until patching is complete by removing the extension or blocking related services
Implement network-level controls to block or restrict Chromoting protocol traffic
Use alternative remote desktop solutions that are not affected by this vulnerability
Configure host-based firewalls to limit inbound connections to Chrome processes