Edge — CraftedSignal Threat Feed

Chromium Use-After-Free Vulnerability in ANGLE (CVE-2026-7359)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:40 +0000

CVE-2026-7359 describes a use-after-free vulnerability present in ANGLE (Almost Native Graphics Layer Engine), a crucial component of the Chromium open-source project. This vulnerability impacts applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the provided source does not give specific exploitation details, use-after-free vulnerabilities can allow for arbitrary code execution. Google Chrome has already addressed this vulnerability, and Microsoft Edge has incorporated the fix from Chromium. This vulnerability matters to defenders because successful exploitation could lead to compromise of the browser and potentially the underlying system.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code that leverages a flaw in ANGLE’s memory management.
A user visits the malicious web page through Chrome or Edge.
The JavaScript code triggers the use-after-free vulnerability by freeing a memory object in ANGLE and then attempting to access it again.
This memory corruption leads to a controlled crash or allows the attacker to overwrite memory with arbitrary data.
The attacker leverages the memory overwrite to inject malicious code into the browser process.
The injected code executes within the context of the browser, granting the attacker access to user data, cookies, and other sensitive information.
The attacker may then use this access to perform actions on behalf of the user, such as stealing credentials, installing malware, or spreading the attack to other systems.
The attacker achieves arbitrary code execution on the user’s system, potentially leading to full system compromise.

Impact

A successful exploit of CVE-2026-7359 could allow an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, data theft, and potentially full system compromise. The scope of impact is broad, affecting any user who visits a malicious webpage while using a vulnerable version of Chrome or Edge. Since Chrome and Edge are widely used, this vulnerability poses a significant risk.

Recommendation

Deploy the Sigma rule Detect Suspicious WebGL Usage to identify potential exploitation attempts targeting ANGLE via WebGL.
Monitor web server logs for suspicious requests (cs-uri-query) that may be related to the exploitation of CVE-2026-7359.
Ensure that all Chrome and Edge installations are updated to the latest versions to patch CVE-2026-7359.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7357)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7357 is a critical use-after-free vulnerability residing within the GPU component of the Chromium rendering engine. This flaw directly impacts Google Chrome and, due to Microsoft Edge’s reliance on Chromium, also affects Edge users. A remote attacker could potentially exploit this vulnerability to execute arbitrary code on a targeted system. The vulnerability stems from improper memory management within the GPU processing routines. While the specific exploitation details are not provided in this brief, successful exploitation generally involves crafting malicious web content to trigger the vulnerability during GPU operations.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that triggers specific GPU functions.
User visits the malicious website using Chrome or Edge.
The browser’s rendering engine processes the malicious JavaScript, leading to the allocation and subsequent freeing of a memory region in the GPU component.
The attacker’s JavaScript code then attempts to access the previously freed memory region, triggering the use-after-free vulnerability.
By manipulating the memory layout, the attacker can overwrite the freed memory with controlled data.
The overwritten memory is later accessed by the GPU, leading to the execution of attacker-controlled code.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker leverages the code execution to escalate privileges or perform other malicious activities.

Impact

Successful exploitation of CVE-2026-7357 can lead to arbitrary code execution on the victim’s machine. The attacker could potentially install malware, steal sensitive data, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability poses a significant risk to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7357.
Apply the latest security updates for Microsoft Edge to address CVE-2026-7357.
Deploy the Sigma rule “Detect Suspicious WebAssembly Execution” to identify potential exploitation attempts involving WebAssembly.

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7338)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7338 is a critical use-after-free vulnerability residing within the Cast component of the Chromium browser engine. Google Chrome and Microsoft Edge (Chromium-based) are both affected by this flaw. While the provided source does not specify the exact vulnerable versions, it indicates that Microsoft Edge ingests Chromium, and thus is affected by vulnerabilities addressed in Chromium releases. Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the user running the browser. This poses a significant risk, as attackers could potentially gain control of the user’s system. Defenders should prioritize patching affected browsers.

Attack Chain

An attacker crafts a malicious webpage or injects malicious code into a legitimate website that utilizes the Cast functionality.
The victim visits the malicious website or interacts with the compromised legitimate website using an affected browser (Chrome or Edge).
The malicious webpage triggers the use-after-free vulnerability in the Cast component.
The vulnerability allows the attacker to access memory that has already been freed.
The attacker overwrites the freed memory with attacker-controlled data.
The attacker manipulates the memory layout to redirect program execution.
The browser attempts to execute code from the attacker-controlled memory location.
This results in arbitrary code execution within the context of the browser process.

Impact

Successful exploitation of CVE-2026-7338 allows an attacker to execute arbitrary code on a victim’s machine. This can lead to complete system compromise, data theft, installation of malware, or other malicious activities. Given the widespread use of Chromium-based browsers like Chrome and Edge, this vulnerability has the potential to impact a large number of users across various sectors. The severity is critical due to the potential for remote code execution.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7338 as detailed in Google Chrome Releases.
Apply the latest security updates for Microsoft Edge (Chromium-based) to address CVE-2026-7338, ensuring the ingested Chromium version contains the fix.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the Cast component.
Enable enhanced browser security features, such as sandboxing and site isolation, to limit the impact of potential exploits.