CVE-2026-7338

EUVD-2026-26164
Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
googlechrome
𝑥
< 147.0.7727.138
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chromium
bookworm
147.0.7727.137-1~deb12u1
fixed
bookworm (security)
149.0.7827.102-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
vulnerable
forky
148.0.7778.178-1
fixed
sid
149.0.7827.102-1
fixed
trixie
147.0.7727.137-1~deb13u1
fixed
trixie (security)
149.0.7827.102-1~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
Common Weakness Enumeration
References
https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html
https://issues.chromium.org/issues/502449857