Browser — CraftedSignal Threat Feed

Chromium Use-After-Free Vulnerability in Media Component (CVE-2026-7355)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7355 is a critical use-after-free vulnerability residing in the Media component of the Chromium browser engine. This vulnerability affects Google Chrome and Microsoft Edge, as Edge incorporates Chromium. A use-after-free vulnerability occurs when an application attempts to use memory after it has been freed, which can lead to crashes, arbitrary code execution, or other unexpected behavior. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. This vulnerability was reported and patched by the Chromium project.

Attack Chain

An attacker crafts a malicious webpage containing specially crafted media content.
A user opens the malicious webpage in a vulnerable version of Chrome or Edge.
The browser attempts to process the malicious media content, triggering the use-after-free vulnerability in the Media component.
The vulnerable code attempts to access a freed memory region.
The attacker gains control of the memory region due to the use-after-free condition.
The attacker injects malicious code into the controlled memory region.
The browser executes the attacker-controlled code.
The attacker achieves arbitrary code execution within the context of the browser process, potentially leading to system compromise.

Impact

Successful exploitation of CVE-2026-7355 can lead to arbitrary code execution within the context of the browser process. An attacker could potentially gain control of the user’s system, steal sensitive information, or install malware. Given the widespread use of Chrome and Edge, a successful exploit could impact a large number of users across various sectors.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7355.
Deploy the Sigma rule “Detect Chromium Use-After-Free in Media Component” to identify potential exploitation attempts.
Enable process creation logging to capture events related to potential exploitation attempts, facilitating detection rule functionality.

Chromium Use-After-Free Vulnerability in Codecs (CVE-2026-7348)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7348 is a critical use-after-free vulnerability residing within the Codecs component of the Chromium browser engine. This vulnerability affects applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the specific details of the vulnerability are documented in Google Chrome Releases, the underlying issue stems from improper memory management within the Codecs library. Successful exploitation could allow an attacker to execute arbitrary code within the context of the affected browser, potentially leading to data theft, system compromise, or other malicious activities. This vulnerability requires immediate attention from organizations utilizing Chrome or Edge.

Attack Chain

An attacker crafts a malicious web page containing specially crafted media content designed to trigger the use-after-free condition in the Codecs library.
The user visits the malicious web page using Google Chrome or Microsoft Edge.
The browser attempts to process the malicious media content, triggering the vulnerable code path within the Codecs library.
The use-after-free condition is triggered when the browser attempts to access memory that has already been freed.
The attacker leverages the use-after-free condition to corrupt memory and gain control of program execution.
The attacker injects and executes arbitrary code within the context of the browser process.
The attacker gains unauthorized access to sensitive data, such as cookies, credentials, or browsing history.
The attacker potentially escalates privileges or installs malware on the user’s system.

Impact

Successful exploitation of CVE-2026-7348 allows an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, such as credentials or browsing history. The attacker could potentially gain full control of the user’s system. Given the widespread use of Chromium-based browsers, a successful exploit could impact a significant number of users across various sectors.

Recommendation

Upgrade Google Chrome to the latest version that addresses this vulnerability; refer to Google Chrome Releases.
Ensure Microsoft Edge is updated to the latest version incorporating the Chromium security patch.
Deploy the Sigma rule “Detect Chromium Codecs Use-After-Free Exploit Attempt” to identify potential exploitation attempts via webserver logs.
Enable webserver logging to capture HTTP requests, which is required for the provided Sigma rule.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7349)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7349 is a use-after-free vulnerability found in the Cast component of the Chromium browser engine. This vulnerability affects Google Chrome and, by extension, Microsoft Edge, as Edge is built upon Chromium. Use-after-free vulnerabilities can allow an attacker to execute arbitrary code or cause a denial-of-service. While the original report comes from Chrome, the nature of Chromium’s shared codebase means that other Chromium-based browsers are also vulnerable. Successful exploitation of this vulnerability could lead to code execution within the context of the browser process. Defenders need to prioritize patching and monitoring for unusual browser behavior.

Attack Chain

An attacker crafts a malicious webpage designed to trigger the use-after-free vulnerability in the Cast component.
The user visits the malicious webpage using a vulnerable version of Chrome or Edge.
The Cast component attempts to access a freed memory location.
The attacker exploits the use-after-free condition to corrupt memory.
The attacker overwrites a function pointer or other critical data structure in memory.
The attacker triggers the execution of the corrupted function pointer or data structure.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker could potentially escalate privileges or perform other malicious activities, such as installing malware or stealing sensitive data.

Impact

Successful exploitation of CVE-2026-7349 could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to data theft, malware installation, or further system compromise. Given the widespread use of Chrome and Edge, this vulnerability has a significant impact. The specific number of potential victims is dependent on the speed of patching, but could potentially affect millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7349.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
Monitor browser process execution for unexpected code loading or memory access patterns using process creation logs.
Implement memory protection techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) to mitigate the impact of successful exploitation.