CVE-2026-7355: Google Chrome Use After Free Vulnerability

CVE-2026-7355 Overview

CVE-2026-7355 is a use-after-free vulnerability in the Media component of Google Chrome. The flaw affects Chrome versions prior to 147.0.7727.138 across Windows, macOS, and Linux. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. The vulnerability falls under CWE-416 and requires user interaction to trigger. Google rated the Chromium security severity as Medium, while NVD scoring places it in the high range due to its impact on confidentiality, integrity, and availability.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome renderer sandbox through a crafted web page, enabling drive-by compromise of unpatched browsers.

Affected Products

Google Chrome versions prior to 147.0.7727.138
Chrome desktop builds on Microsoft Windows, Apple macOS, and Linux
Chromium-based downstream browsers that have not merged the upstream fix

Discovery Timeline

2026-04-28 - CVE-2026-7355 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7355

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Media component. Use-after-free occurs when a program continues to access heap memory after it has been freed, allowing an attacker to manipulate the freed allocation and influence program control flow.

In this case, Chrome's media pipeline retains a dangling reference to a media object after its backing memory has been released. By orchestrating specific media playback or decoding sequences from a crafted HTML page, an attacker reclaims the freed allocation with attacker-controlled data. When Chrome later dereferences the stale pointer, it operates on attacker-controlled memory.

Successful exploitation yields arbitrary code execution inside the Chrome renderer process. The renderer runs inside Chrome's sandbox, which limits direct access to the host operating system. However, renderer compromise is typically the first stage in a chain that pairs the flaw with a separate sandbox escape.

Root Cause

The root cause is improper object lifetime management in the Media subsystem. A code path frees a media-related object while another component still holds a reference, leaving the reference dangling. The upstream commit referenced in Chromium Issue Tracker #498285711 addresses the lifetime handling.

Attack Vector

Exploitation is remote and requires a victim to load attacker-controlled content. The attacker hosts a crafted HTML page containing media elements that drive the vulnerable code path. The victim visits the page through a phishing link, malvertising, or a compromised website. No authentication is required, and the attack complexity is low, though user interaction is needed to load the page.

The vulnerability is described in prose because no public proof-of-concept code is available. See the Google Chrome Desktop Update advisory for vendor details.

Detection Methods for CVE-2026-7355

Indicators of Compromise

Chrome renderer process crashes referencing the Media component in crash dumps or chrome://crashes
Unexpected child process spawning from chrome.exe or the renderer process, especially shell or scripting binaries
Outbound connections from renderer processes to untrusted hosts following media-heavy page loads
Browser navigation history showing visits to unfamiliar domains hosting autoplay media content

Detection Strategies

Inventory Chrome versions across the fleet and flag any installation below 147.0.7727.138
Monitor endpoint telemetry for anomalous process trees originating from Chrome renderer processes
Hunt for renderer crashes correlated with web navigation events to identify exploitation attempts
Apply web proxy and DNS filtering rules against known malicious media-hosting domains

Monitoring Recommendations

Forward Chrome crash telemetry and endpoint process events to a centralized SIEM for correlation
Alert on Chrome child processes that deviate from the expected chrome.exe process lineage
Track patch compliance using software inventory tooling and surface non-compliant hosts daily
Correlate browser navigation logs with EDR telemetry to identify post-exploitation activity

How to Mitigate CVE-2026-7355

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched binaries are loaded into memory
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply vendor updates that incorporate the upstream fix
Enforce automatic Chrome updates via group policy or mobile device management to prevent regression

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update advisory. The patched version is 147.0.7727.138. Technical details are tracked in Chromium Issue Tracker #498285711.

Workarounds

Disable autoplay and restrict media permissions in Chrome enterprise policy to reduce exposure to crafted media content
Deploy site isolation and ensure --site-per-process remains enabled to limit renderer compromise scope
Use web filtering to block access to untrusted sites until the patch is rolled out across the environment
Educate users to avoid clicking unsolicited links and to report unexpected browser crashes to the security team

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read version from Info.plist
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString