What is the CVSS score of CVE-2026-5864?

CVE-2026-5864 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5864?

Yes, a patch is available for CVE-2026-5864. Update the affected software to the latest version immediately.

Google CVE-2026-5864

EUVD-2026-20660 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-08 Chrome

GHSA-q556-g83v-3933

Buffer Overflow Google Heap Overflow

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 14, 2026 - 13:22 NVD

4.2 (MEDIUM) 4.3 (MEDIUM)

CVSS changed

Apr 13, 2026 - 15:22 NVD

6.5 (MEDIUM) 4.2 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20660

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

MEDIUM 6.5

DescriptionCVE.org

Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Google Chrome's WebAudio component prior to version 147.0.7727.55 allows unauthenticated remote attackers to read sensitive information from process memory by serving a crafted HTML page. The vulnerability has a CVSS score of 6.5 and EPSS probability of 0.03% (8th percentile), indicating low real-world exploitation likelihood despite the network attack vector and lack of user interaction requirements. Vendor-released patch is available.

Technical ContextAI

The vulnerability exists in the WebAudio subsystem of Chrome, a C++-based audio processing component within the Chromium rendering engine. CWE-122 (Heap-based buffer overflow) indicates that improper bounds checking in WebAudio memory operations permits an attacker to write beyond allocated heap buffer boundaries. When a specially crafted HTML page is loaded, the overflow condition allows reading adjacent heap memory containing process data. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, meaning all Chrome versions prior to 147.0.7727.55 are in scope. WebAudio, a W3C standard browser API for audio synthesis and processing, is a privileged execution context within the Chrome sandbox.

RemediationAI

Users should immediately update Google Chrome to version 147.0.7727.55 or later. The vendor-released patch is available through Chrome's automatic update mechanism; users can manually check for updates via Chrome Menu > Help > About Google Chrome, which will trigger download and installation of the latest stable release. No workarounds are available for users unable to patch, though disabling WebAudio features (if technically feasible in the deployment context) would reduce attack surface. Organizations should prioritize this update despite the low EPSS score to eliminate network-based memory disclosure. Additional details and acknowledgments are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/490642831.