CVE-2026-7348: Google Chrome Use-After-Free Vulnerability

CVE-2026-7348 Overview

CVE-2026-7348 is a use-after-free vulnerability [CWE-416] in the Codecs component of Google Chrome versions prior to 147.0.7727.138. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page. The flaw affects Chrome installations across Windows, macOS, and Linux platforms.

Google classified the issue as High severity in the Chromium security tracker. Exploitation requires user interaction, specifically loading a malicious web page in a vulnerable browser. The vendor addressed the flaw in the Stable channel update released on April 28, 2026.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome renderer sandbox by tricking a user into visiting a crafted HTML page, providing a foothold for further sandbox escape chains.

Affected Products

Google Chrome versions prior to 147.0.7727.138
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-04-28 - Google releases Chrome 147.0.7727.138 Stable channel update containing the fix
2026-04-28 - CVE-2026-7348 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7348

Vulnerability Analysis

The vulnerability resides in Chrome's Codecs subsystem, which handles media decoding for audio and video content rendered by the browser. A use-after-free condition occurs when the codec pipeline references a heap-allocated object after that object has been deallocated. An attacker who controls the timing of allocations and frees through crafted media content can reclaim the freed memory with attacker-controlled data.

Once the dangling pointer is dereferenced, the codec code operates on attacker-influenced structures. This typically leads to control over a function pointer or virtual table entry, enabling arbitrary code execution within the renderer process. The attack succeeds without authentication and requires only that the victim load the malicious page.

Execution remains confined to the Chrome sandbox. However, renderer compromise is commonly chained with a separate sandbox escape to achieve full system compromise. The Codecs component is a frequent target because it exposes complex binary parsing reachable from any origin.

Root Cause

The root cause is improper lifetime management of objects in the codec pipeline, classified as [CWE-416] Use After Free. Code paths release memory while another reference remains live, and subsequent operations dereference that stale pointer.

Attack Vector

The attack vector is network-based through standard web browsing. An attacker hosts a crafted HTML page that embeds media content designed to trigger the use-after-free in the Codecs component. Delivery channels include malicious advertising, compromised legitimate sites, and phishing links. No credentials are required, but the victim must load the page.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are restricted in the Chromium Issue Tracker entry pending broad patch deployment.

Detection Methods for CVE-2026-7348

Indicators of Compromise

Chrome renderer process crashes referencing codec or media decoder modules in crash dumps and event logs
Outbound connections from chrome.exe child processes to uncategorized or newly registered domains immediately after page load
Unexpected child processes spawned by Chrome renderer processes, which may indicate a chained sandbox escape
Browser telemetry reporting versions of Chrome below 147.0.7727.138 still in production use

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag instances below 147.0.7727.138
Monitor endpoint detection telemetry for anomalous memory access patterns and exception handling within Chrome renderer processes
Inspect web proxy logs for HTML pages serving malformed or unusual media payloads to internal users

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, extension, and crash data for security review
Forward browser and endpoint logs to a central data lake for correlation across renderer crashes, network egress, and process lineage
Track Google's Chrome Releases blog and Chromium issue tracker for follow-up advisories on related codec defects

How to Mitigate CVE-2026-7348

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on every endpoint after the update so the patched binaries are loaded into memory
Verify Chromium-based browser variants such as Edge and Brave for vendor-specific patches addressing the same upstream defect
Block known malicious advertising networks and unrated domains at the web proxy to reduce drive-by exposure

Patch Information

Google released the fix in the Stable channel update on April 28, 2026. The patched version is Chrome 147.0.7727.138 for desktop platforms. Details are published in the Chrome Releases advisory. Enterprise administrators should deploy the update through managed software distribution tools and confirm rollout via Chrome Browser Cloud Management or equivalent telemetry.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Restrict browsing to trusted sites through enterprise web filtering until updates are deployed
Disable or limit third-party advertising and embedded media on internal portals to reduce attack surface
Enforce site isolation and strict sandbox policies through Chrome enterprise policies

bash

# Verify the installed Chrome version on Linux endpoints
google-chrome --version

# Force update via the Chrome enterprise policy on managed Windows hosts
# (set in HKLM\SOFTWARE\Policies\Google\Update)
# UpdateDefault = 1 (Always update)
# AutoUpdateCheckPeriodMinutes = 60