What is the CVSS score of CVE-2026-5862?

CVE-2026-5862 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5862?

Google Chrome versions before 147.0.7727.55 contain a remote code execution vulnerability in the V8 engine that allows unauthenticated attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-5862?

Within 24 hours: Audit Chrome deployment across all endpoints and identify systems running versions prior to 147.0.7727.55. Within 7 days: Deploy Chrome 147.0.7727.55 or later to all affected systems through your enterprise update management system; enforce automatic updates where possible. Within 30 days: Verify patch compliance across all endpoints and document remediation completion.

Google CVE-2026-5862

EUVD-2026-20658 HIGH

2026-04-08 Chrome

GHSA-rfr9-hj39-mwqc

RCE Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20658

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 147.0.7727.55 allows unauthenticated attackers to execute arbitrary code within the browser's sandbox through a crafted HTML page exploiting an inappropriate implementation in the V8 JavaScript engine. User interaction is required (visiting a malicious webpage). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.04% (11th percentile), indicating low observed attacker interest despite high CVSS severity.

Technical ContextAI

This vulnerability affects Google Chrome's V8 JavaScript engine, which compiles and executes JavaScript code in Chrome and Chromium-based browsers. An 'inappropriate implementation' represents a flaw in how V8 handles certain JavaScript operations or memory management during compilation or runtime execution. The CPE string (cpe:2.3:a:google:chrome) confirms all Chrome versions below 147.0.7727.55 are affected. While execution occurs within Chrome's sandbox architecture (limiting system-level impact), sandbox escape vulnerabilities are often chained with such flaws to achieve full system compromise. The lack of assigned CWE suggests the root cause may involve multiple weakness classes or represents a novel implementation flaw specific to V8's architecture.

RemediationAI

Vendor-released patch: Update Google Chrome to version 147.0.7727.55 or later immediately through Chrome's built-in update mechanism (Settings > About Chrome) or by downloading the latest version from google.com/chrome. Chrome typically auto-updates within 24-48 hours for most users, but manual verification is recommended for enterprise environments. For organizations managing Chrome via Group Policy or MDM solutions, push version 147.0.7727.55 through your standard deployment channels. No effective workarounds exist short of disabling JavaScript entirely (which breaks modern web functionality). Organizations unable to patch immediately should implement defense-in-depth controls including restricting access to untrusted websites via web filtering, deploying browser isolation technologies for high-risk browsing, and ensuring endpoint detection solutions monitor for suspicious browser process behavior. Full advisory and technical discussion available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/470566252.