CVE-2026-7338

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-733809.8Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-733819.1Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-733827.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews CVE-2026-733834.9Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.CVE-2026-733847.5Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.CVE-2026-733857.5Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.CVE-2026-733867.5Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.CVE-2026-733878.1Unauthenticated Local File Inclusion in Resido <= 1.5 versions.CVE-2026-733889.3Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.CVE-2026-733899.8Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.CVE-2026-73398.8Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption viaCVE-2026-733909.8Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
CVE-2026-7338: High severity, CVSS 7.5 | Vulnix