CVE-2026-7356 Overview
CVE-2026-7356 is a use-after-free vulnerability in the Navigation component of Google Chrome versions prior to 147.0.7727.138. A remote attacker can exploit this flaw by serving a crafted HTML page, leading to arbitrary code execution within the browser process. The Chromium project rated the security severity as High, and the CVE carries a CVSS 3.1 score of 8.8. The vulnerability is tracked under CWE-416: Use After Free and affects Chrome on Windows, macOS, and Linux desktops.
Critical Impact
A remote attacker can execute arbitrary code in the renderer by enticing a user to visit a crafted web page, enabling full browser compromise and a foothold for sandbox escape chains.
Affected Products
- Google Chrome prior to 147.0.7727.138 on Microsoft Windows
- Google Chrome prior to 147.0.7727.138 on Apple macOS
- Google Chrome prior to 147.0.7727.138 on Linux
Discovery Timeline
- 2026-04-28 - CVE-2026-7356 published to NVD following the Chrome Stable Channel Update for Desktop
- 2026-04-30 - Last updated in NVD database
Technical Details for CVE-2026-7356
Vulnerability Analysis
The flaw resides in Chrome's Navigation subsystem, which orchestrates frame lifecycle, history state, and document commit operations. A use-after-free condition arises when navigation logic references a heap object after it has been freed during a frame or document transition. An attacker who controls page content can trigger the freed object's reuse and cause the browser to operate on attacker-influenced memory.
Successful exploitation allows arbitrary code execution within the renderer process. Adversaries typically chain renderer compromises with separate sandbox escape vulnerabilities to achieve full system compromise. User interaction is required: the victim must load the malicious page in Chrome.
Root Cause
The root cause is improper object lifetime management (CWE-416) in the Navigation code path. A pointer to a Navigation-related object remains in use after the object has been deallocated, allowing the renderer to dereference stale memory. Use-after-free conditions in Chrome's Navigation stack often stem from race conditions between asynchronous navigation events and frame teardown.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the victim through phishing, malvertising, or a compromised third-party site. When the page loads, embedded scripts and frame manipulations drive the navigation flow that triggers the dangling pointer. The technical disclosure is restricted in the Chromium Issue Tracker entry 497769116 until the patch reaches a majority of users.
No public proof-of-concept exploit has been released. The current EPSS probability is 0.086%.
Detection Methods for CVE-2026-7356
Indicators of Compromise
- Chrome renderer process crashes with access violation or SIGSEGV signatures around navigation events, particularly during cross-origin frame transitions.
- Unexpected child processes spawned by chrome.exe or the renderer, such as command interpreters, scripting hosts, or rundll32.exe.
- Outbound network connections from Chrome to untrusted hosts immediately following a navigation crash.
Detection Strategies
- Monitor endpoint telemetry for Chrome browser versions below 147.0.7727.138 and flag hosts running unpatched builds.
- Hunt for renderer process anomalies including unexpected memory protection changes, suspicious thread creation, or shellcode-like behavior in child processes.
- Correlate web proxy logs with endpoint events to identify users who visited low-reputation domains shortly before a Chrome crash or anomalous process tree.
Monitoring Recommendations
- Ingest Chrome crash reports and browser version inventory into your SIEM for fleet-wide visibility on patch status.
- Alert on Chrome processes loading unsigned modules or writing executables to user-writable paths such as %LOCALAPPDATA%.
- Track DNS and HTTP telemetry for known malvertising and exploit-kit infrastructure delivering crafted HTML payloads.
How to Mitigate CVE-2026-7356
Immediate Actions Required
- Update Google Chrome to version 147.0.7727.138 or later on Windows, macOS, and Linux endpoints.
- Restart Chrome on all managed devices to ensure the patched binary is loaded into memory.
- Audit your environment for users running outdated Chrome builds and prioritize remediation for high-risk roles such as executives and developers.
Patch Information
Google released the fix in the Chrome Stable Channel update published on April 28, 2026. Administrators should deploy version 147.0.7727.138 or later, as documented in the Chrome Releases blog. Enterprise managed installations should use Chrome Browser Cloud Management or group policy to enforce automatic updates.
Workarounds
- Enable Chrome's Site Isolation and Enhanced Safe Browsing features to reduce the blast radius of renderer compromise.
- Restrict browsing on sensitive endpoints to allow-listed domains until the patch is fully deployed.
- Apply browser hardening group policies that disable unnecessary features and enforce sandboxing for all renderer processes.
# Verify Chrome version on Linux
google-chrome --version
# Force update on managed Windows endpoints via GoogleUpdate
"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
# macOS: trigger Chrome update check
open -a "Google Chrome" --args --check-for-update-interval=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
