What is the CVSS score of CVE-2026-5859?

CVE-2026-5859 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5859?

Google Chrome versions prior to 147.0.7727.55 contain a critical integer overflow vulnerability in the WebML component that allows remote attackers to corrupt heap memory through malicious websites,…. A patch is available.

How to fix or mitigate CVE-2026-5859?

Within 24 hours: Verify current Chrome deployment versions across endpoints using your endpoint management system and enable automatic updates. Within 7 days: Deploy Chrome 147.0.7727.55 or later to all endpoints using your standard patch management process; confirm deployment completion. Within 30 days: Audit Chrome deployment logs to ensure 100% of organizational instances have been updated to 147.0.7727.55 or later and establish quarterly Chrome update verification procedures.

Google CVE-2026-5859

EUVD-2026-20653 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-7gpj-6vgg-g937

Buffer Overflow Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:22 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20653

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Integer overflow in Google Chrome's WebML component (versions prior to 147.0.7727.55) enables remote attackers to trigger heap corruption via malicious HTML pages, requiring only user interaction to visit a crafted website. The vendor-assigned severity is Critical, though EPSS indicates only 0.03% probability of exploitation in the wild (9th percentile), and no public exploit identified at time of analysis. Patch available in Chrome 147.0.7727.55 and later.

Technical ContextAI

WebML (Web Machine Learning) is Google Chrome's implementation for running machine learning models directly in the browser. This vulnerability stems from an integer overflow (CWE-472) in WebML's processing logic, where arithmetic operations on integer values can wrap around to produce unexpectedly small or negative results. When exploited, this overflow condition corrupts heap memory layout, potentially allowing an attacker to control memory allocation sizes and positions. The affected product (cpe:2.3:a:google:chrome) encompasses all Chrome versions before 147.0.7727.55 across desktop platforms. Integer overflows in memory management are particularly dangerous in browser contexts because they can bypass address space layout randomization (ASLR) and other exploit mitigations, enabling reliable exploitation of the underlying heap corruption primitive.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later, which contains the fix for this integer overflow vulnerability. Chrome typically auto-updates within 24-48 hours of release; users can force an immediate update by navigating to chrome://settings/help or restarting the browser when prompted. Enterprise deployments using managed Chrome policies should push version 147.0.7727.55 through their update channels. The official stable channel update announcement is available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html with technical details at https://issues.chromium.org/issues/494158331. No workarounds are provided; patching is the only effective mitigation. Organizations unable to patch immediately should consider restricting Chrome usage for high-risk users or deploying enhanced web filtering to block known-malicious domains, though these controls provide limited protection against zero-interaction browser vulnerabilities. Verify patch deployment by checking chrome://version shows 147.0.7727.55 or higher.