Loading story…
Google Chrome addressed three use-after-free vulnerabilities tracked as CVE-2026-7347, CVE-2026-7363, and CVE-2026-7344 in versions prior to 147.0.7727.138. The bugs affect the Chromoting, Canvas, and Accessibility components, respectively, and all were classified under CWE-416. Two of the flaws were rated critical: CVE-2026-7363 allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while CVE-2026-7344 could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content.
The third issue, CVE-2026-7347, was rated high severity and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with CVE-2026-7363 and CVE-2026-7344 carrying the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to 147.0.7727.138 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On April 29, 2026, the CVE records were updated to add CVSS v3.1 scoring details. The added vectors described network-reachable attack paths and high confidentiality, integrity, and availability impact, with user interaction required for the Canvas and Accessibility flaws but not for the Chromoting issue.
The disclosed CVE entries state that affected versions are those prior to Chrome 147.0.7727.138, indicating that this version contains fixes for the three flaws. The issues include a high-severity Chromoting remote code execution bug and critical Canvas and Accessibility use-after-free vulnerabilities.
On April 28, 2026, Google received CVE records for CVE-2026-7347, CVE-2026-7363, and CVE-2026-7344. The vulnerabilities affect Chrome prior to 147.0.7727.138 and involve use-after-free issues in Chromoting, Canvas, and Accessibility on Windows, with potential remote code execution or sandbox escape impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google disclosed two high-severity use-after-free vulnerabilities in Chrome, **CVE-2026-6302** and **CVE-2026-6304**, affecting versions prior to **`147.0.7727.101`**. The flaws reside in the browser's **Video** and **Graphite** components and can be triggered with a crafted HTML page. **CVE-2026-6302** could allow a remote attacker to execute arbitrary code inside the sandbox, while **CVE-2026-6304** could let an attacker who has already compromised the renderer process potentially escape Chrome's sandbox. Both issues are classified as **`CWE-416`** use-after-free bugs and were rated **High** severity by Chromium. The published CVSS v3.1 vectors indicate significant potential impact to confidentiality, integrity, and availability, with **CVE-2026-6302** scored as **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`** and **CVE-2026-6304** as **`AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`**. Organizations running Chrome should prioritize upgrading to **`147.0.7727.101`** or later to mitigate the risk from malicious web content targeting these memory-safety flaws.
Jun 29, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 2, 2026
Google Chrome disclosed two high-severity use-after-free vulnerabilities, **`CVE-2026-6316`** in the **Forms** component and **`CVE-2026-6360`** in the **FileSystem** component. Both flaws affect Chrome versions prior to **`147.0.7727.101`** and can be triggered by a remote attacker using a crafted HTML page. In the Forms bug, successful exploitation could lead to arbitrary code execution inside the browser sandbox, while the FileSystem bug could enable exploitation through object corruption. Both issues are classified as **`CWE-416`** and carry a **CVSS v3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability with no privileges required beyond user interaction. Chromium rated each vulnerability as **High** severity and published fixes in Chrome **`147.0.7727.101`**, with references pointing to Chrome release notes and Chromium issue tracker entries.
Jun 29, 2026