CVE-2026-7359: Google Chrome Use After Free Vulnerability

CVE-2026-7359 Overview

CVE-2026-7359 is a use-after-free vulnerability [CWE-416] in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome versions prior to 147.0.7727.138. ANGLE translates OpenGL ES API calls into the native graphics APIs used by Chrome on Windows, macOS, and Linux. A remote attacker who has already compromised the renderer process can exploit this flaw through a crafted HTML page to potentially escape the Chrome sandbox. Chromium engineers classified the issue as High severity. The vulnerability affects Chrome desktop builds across all major operating systems.

Critical Impact
Successful exploitation enables sandbox escape from a compromised renderer, allowing code execution in a higher-privileged Chrome process and breaking out of browser isolation boundaries.

Affected Products

Google Chrome versions prior to 147.0.7727.138
Chrome desktop builds for Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers consuming the affected ANGLE component

Discovery Timeline

2026-04-28 - CVE-2026-7359 published to NVD
2026-04-28 - Google releases Chrome 147.0.7727.138 Stable Channel update for desktop
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7359

Vulnerability Analysis

The flaw is a use-after-free condition within ANGLE, the graphics translation layer that backs WebGL and other GPU-accelerated APIs in Chrome. ANGLE marshals graphics commands between the renderer process and the GPU process, making it a frequent target for sandbox-escape research. When a freed ANGLE object is later dereferenced, an attacker controlling adjacent heap memory can manipulate the dangling pointer to influence control flow. Because ANGLE handles untrusted graphics state from web content, a crafted HTML page can trigger the unsafe object lifecycle. The condition requires user interaction such as visiting a malicious page. Exploitation depends on the attacker first holding code execution in the renderer process, where this bug becomes a stepping stone toward broader system compromise.

Root Cause

The root cause is incorrect object lifetime management inside ANGLE, where a graphics resource is freed while a reference to it remains in use. Subsequent operations on the dangling pointer corrupt memory the attacker can shape via WebGL state. The bug falls into the CWE-416 Use After Free class, consistent with prior ANGLE security issues tracked by the Chromium project.

Attack Vector

Exploitation proceeds through a multi-stage chain. An attacker first delivers a crafted HTML page that compromises the renderer process, typically by chaining another renderer-side flaw. The attacker then uses CVE-2026-7359 from within that compromised renderer to trigger the use-after-free in ANGLE, which executes in a more privileged context. Pivoting from the renderer through ANGLE can yield code execution outside the renderer sandbox. The Chromium issue tracker entry 496284494 tracks the fix. See the Google Chrome Desktop Update advisory for vendor-supplied details.

Detection Methods for CVE-2026-7359

Indicators of Compromise

Chrome renderer or GPU process crashes referencing ANGLE modules such as libGLESv2.dll, libEGL.dll, or equivalent shared objects on macOS and Linux.
Outbound network connections from a Chrome child process to attacker-controlled infrastructure shortly after a user visits an untrusted page.
Unexpected child processes spawned by chrome.exe or its helper processes following WebGL-heavy page loads.

Detection Strategies

Monitor browser process telemetry for anomalous module loads, memory protection changes, and crashes within ANGLE binaries.
Hunt for renderer-to-GPU process exploitation patterns where a renderer triggers GPU process crashes correlated with HTML or WebGL content.
Correlate browser version data from endpoint inventory against the fixed build 147.0.7727.138 to identify exposed hosts.

Monitoring Recommendations

Track Chrome version compliance across managed endpoints and alert on hosts running builds older than 147.0.7727.138.
Ingest browser crash telemetry and EDR process events into a central data lake for retrospective hunting on ANGLE-related stack frames.
Review proxy and DNS logs for traffic to newly registered domains immediately following Chrome process anomalies.

How to Mitigate CVE-2026-7359

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after deploying the update so the patched binaries are loaded into running sessions.
Audit Chromium-based browsers and embedded WebView components for vendor patches incorporating the fixed ANGLE revision.

Patch Information

Google addressed CVE-2026-7359 in the Chrome Stable Channel release 147.0.7727.138 for desktop, published on April 28, 2026. Refer to the Google Chrome Desktop Update advisory and the Chromium issue tracker entry for the authoritative fix details. Enterprise administrators should deploy the update through Chrome Browser Cloud Management, Group Policy, or the equivalent macOS and Linux package channels.

Workarounds

Restrict access to untrusted web content using URL filtering or browser isolation while patches roll out.
Disable hardware-accelerated graphics and WebGL through enterprise policy as a temporary mitigation where compatible.
Enforce the Chrome SitePerProcess policy and site isolation to raise the cost of chaining renderer compromises with this bug.

bash

# Configuration example: enforce minimum Chrome version and disable WebGL via policy (Linux managed policies)
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/cve-2026-7359.json
{
  "DefaultWebGLSetting": 2,
  "HardwareAccelerationModeEnabled": false,
  "SitePerProcess": true
}
EOF