PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7341 Google CVE debrief

CVE-2026-7341 is a high-severity vulnerability in Google Chrome prior to version 147.0.7727.138. The vulnerability is caused by a use-after-free issue in WebRTC, which allows remote attackers to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability has significant operational impact due to its high severity score of 8.8 and potential for remote code execution. Users of Google Chrome should update to the latest version to mitigate this vulnerability.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-07-24
Advisory published
2026-04-28
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.138 should update to the latest version to mitigate this vulnerability. This vulnerability has a high severity score of 8.8 and can be exploited by remote attackers. Operators, platform administrators, and security teams should prioritize updating Chrome and monitoring for potential exploitation attempts.

Technical summary

The vulnerability is caused by a use-after-free issue in WebRTC, which allows remote attackers to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability has a high severity score of 8.8 and is classified as CWE-416. It affects Google Chrome prior to version 147.0.7727.138. Defenders should focus on updating Chrome to the latest version and monitoring for suspicious activity.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.138 or later
  • Monitor for suspicious activity
  • Implement compensating controls
  • Inventory checks for vulnerable versions
  • Review relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record was published on 2026-04-28T23:16:21.690Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. This vulnerability affects Google Chrome prior to version 147.0.7727.138. The evidence provided is limited, and defenders should verify the affected scope and severity with the vendor. The CVE record was sourced from nvd_modified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7341 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7341

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7341 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7341

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.