Loading story…
Google disclosed two high-severity Chrome vulnerabilities in WebRTC, tracked as CVE-2026-7336 and CVE-2026-7341, that affect versions prior to 147.0.7727.138. Both bugs are classified as CWE-416 use-after-free issues and can be triggered when a user loads a crafted HTML page, allowing a remote attacker to achieve arbitrary code execution inside the browser sandbox.
The CVE records link the flaws to Chrome release notes and Chromium issue tracker entries, and both were published by Google's Chrome security team before receiving updates with CVSS details. CVE-2026-7336 was assigned a high-severity CVSS v3.1 rating reflecting impacts to confidentiality, integrity, and availability, while CVE-2026-7341 was later updated to clarify that exploitation requires user interaction, correcting an earlier scoring entry while preserving its overall high-impact assessment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On April 29, 2026, the CVE-2026-7341 record was modified to change its CVSS v3.1 vector from no user interaction required to user interaction required. The update preserved the overall high-impact assessment and reflected a temporary addition and later removal of the earlier vector entry.
On April 29, 2026, the CVE-2026-7336 record was updated to add CVSS v3.1 scoring information while retaining its classification as a high-severity CWE-416 use-after-free issue. References to the Chrome Releases blog and Chromium issue tracker were included.
On April 28, 2026, CVE-2026-7336 and CVE-2026-7341 were published for use-after-free vulnerabilities in Google Chrome's WebRTC component. The flaws affect Chrome versions prior to 147.0.7727.138 and could allow remote code execution in the browser sandbox via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google disclosed two high-severity use-after-free vulnerabilities in Chrome, **CVE-2026-6302** and **CVE-2026-6304**, affecting versions prior to **`147.0.7727.101`**. The flaws reside in the browser's **Video** and **Graphite** components and can be triggered with a crafted HTML page. **CVE-2026-6302** could allow a remote attacker to execute arbitrary code inside the sandbox, while **CVE-2026-6304** could let an attacker who has already compromised the renderer process potentially escape Chrome's sandbox. Both issues are classified as **`CWE-416`** use-after-free bugs and were rated **High** severity by Chromium. The published CVSS v3.1 vectors indicate significant potential impact to confidentiality, integrity, and availability, with **CVE-2026-6302** scored as **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`** and **CVE-2026-6304** as **`AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`**. Organizations running Chrome should prioritize upgrading to **`147.0.7727.101`** or later to mitigate the risk from malicious web content targeting these memory-safety flaws.
Jun 29, 2026
Google Chrome disclosed two high-severity use-after-free vulnerabilities, **`CVE-2026-6316`** in the **Forms** component and **`CVE-2026-6360`** in the **FileSystem** component. Both flaws affect Chrome versions prior to **`147.0.7727.101`** and can be triggered by a remote attacker using a crafted HTML page. In the Forms bug, successful exploitation could lead to arbitrary code execution inside the browser sandbox, while the FileSystem bug could enable exploitation through object corruption. Both issues are classified as **`CWE-416`** and carry a **CVSS v3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability with no privileges required beyond user interaction. Chromium rated each vulnerability as **High** severity and published fixes in Chrome **`147.0.7727.101`**, with references pointing to Chrome release notes and Chromium issue tracker entries.
Jun 29, 2026