What is the CVSS score of CVE-2026-5863?

CVE-2026-5863 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5863?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-5863?

Within 24 hours: Identify all Chrome deployments across endpoints and mobile devices using inventory tools. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to all user devices via your patch management system or mobile device management (MDM) platform; prioritize systems with internet-facing browser usage. Within 30 days: Verify 100% patch compliance through vulnerability scanning; document remediation completion and update your software asset inventory.

Google CVE-2026-5863

EUVD-2026-20659 HIGH

Improper Access Control (CWE-284)

2026-04-08 Chrome

GHSA-j44f-447f-h94p

Authentication Bypass RCE Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20659

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 147.0.7727.55) allows attackers to execute arbitrary code within the browser sandbox via malicious HTML pages. Publicly available exploit code exists. While CVSS scored 8.8 (High), EPSS indicates low exploitation probability (0.04%, 11th percentile), suggesting limited real-world targeting despite proof-of-concept availability. No CISA KEV listing confirms active exploitation campaigns.

Technical ContextAI

V8 is Google Chrome's high-performance JavaScript and WebAssembly engine, responsible for executing web application code. This vulnerability stems from an inappropriate implementation flaw in V8's code generation or optimization pipeline, enabling attackers to escape V8's internal security constraints and achieve arbitrary code execution within Chrome's sandbox environment. While sandboxed execution limits direct system access, successful exploitation provides attackers control over browser processes, enabling data theft from the browser context, session hijacking, or preparation for sandbox escape chains. The vulnerability affects the core JavaScript runtime that processes all web content, making it broadly triggerable through any HTML page containing malicious scripts. CPE data identifies Google Chrome as the affected product across all platforms where Chrome 147.x versions prior to 147.0.7727.55 were deployed.

RemediationAI

Vendor-released patch: Update Google Chrome to version 147.0.7727.55 or later immediately. Chrome's automatic update mechanism will deploy this fix for most users within 48-72 hours of release. Enterprise administrators should verify update deployment via Chrome Browser Cloud Management or GPO policies. Manual update verification: Navigate to chrome://settings/help to force update check and confirm version 147.0.7727.55+ is installed. No effective workarounds exist for this V8 engine flaw beyond disabling JavaScript entirely (which breaks modern web functionality). Official vendor advisory with complete remediation guidance: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Chromium bug tracker details: https://issues.chromium.org/issues/484527367.