CVE-2026-7361

HighCVSS 8.8/10Last modified Jul 24, 2026

Description

Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 147.0.7727.138, < 147.0.7727.138

References

https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.htmlVendor Advisory
https://issues.chromium.org/issues/493221953Permissions Required

Timeline

Published: Apr 28, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-736105.8SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire st CVE-2026-736116.8File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default CVE-2026-736128.1File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing a CVE-2026-736138.2filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allo CVE-2026-736148.8Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code ex CVE-2026-736158.8Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quo CVE-2026-736166.5OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belong CVE-2026-736177.1Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enr CVE-2026-736188.3Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameter CVE-2026-736196.5GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file CVE-2026-73626.5IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2 CVE-2026-736208.1GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass u