What is the CVSS score of CVE-2026-5861?

CVE-2026-5861 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5861?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code within the browser sandbox when…. A patch is available.

How to fix or mitigate CVE-2026-5861?

Within 24 hours: verify current Chrome version across the organization (check chrome://version on all instances). Within 7 days: deploy Chrome 147.0.7727.55 or later via your endpoint management system to all user and development machines; prioritize systems handling sensitive data or development activities. Within 30 days: confirm 100% deployment completion through inventory scanning and audit Chrome update logs to validate patch application across all endpoints.

Chrome CVE-2026-5861

EUVD-2026-20657 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-9jm7-cgmm-6qg2

Memory Corruption Denial Of Service Use After Free RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20657

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 147.0.7727.55) allows unauthenticated remote attackers to execute arbitrary code within the sandbox by exploiting a use-after-free memory corruption vulnerability through a malicious HTML page. User interaction (visiting a crafted website) is required. No public exploit identified at time of analysis, with EPSS probability at 4% (11th percentile), indicating relatively low immediate exploitation risk despite high CVSS severity.

Technical ContextAI

This vulnerability affects the V8 JavaScript engine, Google's open-source high-performance ECMAScript and WebAssembly engine that powers Chrome's JavaScript execution. The issue stems from a use-after-free condition (CWE-416), a classic memory corruption flaw where code continues to reference memory after it has been freed. In V8's context, this typically occurs during object lifecycle management, garbage collection race conditions, or improper handling of JavaScript object references during compilation or optimization. When triggered, the freed memory can be reallocated for different purposes, allowing an attacker to manipulate data structures and hijack control flow. The CPE identifier cpe:2.3:a:google:chrome confirms this affects the Chrome browser application specifically, with the vulnerability residing in V8's core engine rather than browser-specific features.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. Chrome typically auto-updates within 24-48 hours of release; users can manually trigger updates by navigating to chrome://settings/help, clicking 'Check for updates', and restarting the browser when prompted. Enterprise administrators using managed Chrome deployments should verify that auto-update policies are enabled or push the update through their software distribution infrastructure. For organizations unable to immediately patch, temporary risk mitigation includes restricting browser access to trusted sites only, implementing network-level web filtering to block known malicious domains, and educating users about phishing and untrusted website risks. However, these workarounds provide minimal protection given the ubiquity of JavaScript on the web, making patching the only effective remediation. Full vendor advisory and patch details are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.