PT-2026-35833 · Google · Google Chrome

C6Eed09Fc8B174B0F3Eebedcceb1E792 · Published 2026-03-19 · Updated 2026-05-05 · CVE-2026-7333

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.138

Description A use after free (a condition where a program continues to use a memory address after it has been freed) in the GPU component allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This occurs when modifying the surface activation group vector while iterating through existing entries.

Recommendations Update to version 147.0.7727.138 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-07082

CVE-2026-7333

ECHO-86E7-62A2-45FC

OPENSUSE-SU-2026:10689-1

Affected Products

Google Chrome

References · 43

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7333 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10689-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7333 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-7333 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07082 · Security Note
• https://suse.com/security/cve/CVE-2026-7338 · Note
• https://suse.com/security/cve/CVE-2026-7345 · Note
• https://issues.chromium.org/issues/493955227 · Note
• https://suse.com/security/cve/CVE-2026-7346 · Note
• https://twitter.com/windowsforum/status/2050043292864143809 · Twitter Post
• https://suse.com/security/cve/CVE-2026-7352 · Note
• https://suse.com/security/cve/CVE-2026-7335 · Note
• https://suse.com/security/cve/CVE-2026-7339 · Note
• https://suse.com/security/cve/CVE-2026-7344 · Note