Quick answers
- Is CVE-2026-7333 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7333 being exploited in the wild.
- How severe is CVE-2026-7333?
- Critical severity, with a CVSS score of 9.6, published 28 April 2026.
- Which products and versions are affected?
- Google Chrome prior to 147.0.7727.138.
- Is there a fix for CVE-2026-7333?
- A patch was published on 2026-04-28: Fixed in version 147.0.7727.138 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-7333 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-7333?
- Check whether you run Apple macOS, Google Chrome, Linux Kernel or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (UAF) vulnerability exists in the GPU component of Google Chrome prior to version 147.0.7727.138. The flaw is triggered when the browser improperly manages memory during graphics processing tasks. A remote, unauthenticated attacker can exploit this by enticing a user to visit a specially crafted HTML page. Successful exploitation can lead to a sandbox escape, allowing the attacker to execute arbitrary code outside the restricted browser environment on the host operating system. Google has released version 147.0.7727.138 to address this issue.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-03-19: other: Reported to vendor
- 2026-04-28: patched: Fixed in version 147.0.7727.138
- 2026-04-28: advisory: NVD publication date