What is the CVSS score of CVE-2026-5860?

CVE-2026-5860 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5860?

Google Chrome versions prior to 147.0.7727.55 contain a high-severity remote code execution vulnerability in the WebRTC component that allows attackers to execute arbitrary code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-5860?

Within 24 hours: Inventory Chrome deployment across all endpoints and verify current version numbers. Within 7 days: Deploy Chrome 147.0.7727.55 or later to 100% of endpoints using your standard patch management process; configure auto-update settings to enforce mandatory updates. Within 30 days: Verify patch compliance across all devices and document patch deployment records for audit purposes.

Google CVE-2026-5860

EUVD-2026-20655 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-rjhq-52xc-gxc5

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20655

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to 147.0.7727.55 allows unauthenticated remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page exploiting a use-after-free vulnerability in the WebRTC component. The attack requires user interaction (visiting a malicious page). EPSS probability is low (0.03%, 10th percentile), and no public exploit or active exploitation (KEV) has been identified at time of analysis. Vendor-released patch available in Chrome 147.0.7727.55.

Technical ContextAI

WebRTC (Web Real-Time Communication) is a browser API enabling peer-to-peer audio, video, and data transmission without plugins. This vulnerability (CWE-416: Use After Free) occurs when WebRTC code attempts to access memory after it has been freed, creating a dangling pointer. In C/C++ codebases like Chromium, use-after-free conditions allow attackers to manipulate heap memory allocations, potentially redirecting program execution flow. The affected component is within Google Chrome's WebRTC implementation (cpe:2.3:a:google:chrome), specifically impacting all versions prior to 147.0.7727.55. While the vulnerability enables arbitrary code execution, it is constrained to Chrome's sandbox environment, which limits system-level access but still permits actions within the browser context such as data exfiltration, session hijacking, or further sandbox escape attempts.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately through the browser's built-in update mechanism (Settings > About Chrome) or via enterprise deployment tools. Chrome's auto-update feature typically deploys patches within 24-48 hours of release for most users. Enterprise administrators should verify deployment via Chrome Browser Cloud Management or Group Policy configurations. For Chromium-based browser users, consult respective vendor advisories (Microsoft Edge, Brave, Opera) and apply corresponding updates when available. Organizations unable to patch immediately should implement defense-in-depth controls: restrict access to untrusted websites via proxy filtering, enable Enhanced Safe Browsing in Chrome settings, and deploy browser isolation technologies for high-risk users. Full vendor advisory and patch details available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and tracked under Chromium bug tracker issue 486495143.