What is the CVSS score of CVE-2026-5858?

CVE-2026-5858 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5858?

Google Chrome versions below 147.0.7727.55 contain a critical remote code execution vulnerability in the WebML component that allows attackers to execute arbitrary code on user systems through…. A patch is available.

How to fix or mitigate CVE-2026-5858?

Within 24 hours: Identify all Chrome deployments in your environment and confirm current version levels. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to all endpoints through your standard patch management process; prioritize systems with elevated risk exposure (research, finance, executive workstations). Within 30 days: Verify 100% deployment completion and validate that no systems remain below version 147.0.7727.55 through endpoint monitoring tools.

Chrome CVE-2026-5858

EUVD-2026-20651 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-08 Chrome

GHSA-88x7-8x6j-5jw9

RCE Google Buffer Overflow Heap Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:22 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20651

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 147.0.7727.55 allows unauthenticated attackers to execute arbitrary code by exploiting a heap buffer overflow in the WebML component through specially crafted HTML pages. The vulnerability requires user interaction (visiting a malicious page) but presents critical risk with high impact to confidentiality, integrity, and availability. EPSS score of 0.03% (9th percentile) indicates low probability of imminent exploitation in the wild, with no public exploit identified at time of analysis and no CISA KEV listing confirming active exploitation.

Technical ContextAI

The vulnerability affects Google Chrome's WebML (Web Machine Learning) component, which enables machine learning capabilities directly in web browsers. The flaw is classified as CWE-122 (Heap-based Buffer Overflow), occurring when the WebML parser or API handler fails to properly validate input boundaries during memory allocation operations on the heap. When processing malicious HTML content containing crafted WebML instructions, the insufficient bounds checking allows data to overflow allocated heap memory regions. This memory corruption can overwrite adjacent heap structures, function pointers, or object metadata, enabling attackers to hijack program control flow. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) encompasses all Chrome installations across platforms (Windows, macOS, Linux) running versions below 147.0.7727.55.

RemediationAI

Immediately update Google Chrome to version 147.0.7727.55 or later through the browser's built-in update mechanism (Settings → About Chrome) or via enterprise deployment tools for managed environments. The vendor-released patch addresses the heap buffer overflow by implementing proper bounds checking in the WebML component's input validation routines. For enterprise environments unable to immediately deploy the update, implement defense-in-depth controls including browser isolation technologies (remote browser isolation or application-level sandboxing), restrict access to untrusted websites via web filtering policies, and enforce Content Security Policy headers on internal web applications. Organizations using Chromium-based derivative browsers should consult their respective vendors for patched versions incorporating the upstream Chromium fix. The official Chrome security advisory with complete remediation guidance is available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, and technical implementation details can be reviewed in the Chromium bug tracker at https://issues.chromium.org/issues/493319454.