What is the CVSS score of CVE-2026-5865?

CVE-2026-5865 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5865?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code on user systems through…. A patch is available.

How to fix or mitigate CVE-2026-5865?

Within 24 hours: Identify all Chrome deployments and versions in use across the organization using endpoint management tools. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to all endpoints via your standard patch management process; consider mandatory updates for high-risk user groups first. Within 30 days: Verify 100% deployment completion and audit any systems still running versions prior to 147.0.7727.55.

Chrome CVE-2026-5865

EUVD-2026-20661 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-08 Chrome

Memory Corruption Google RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20661

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within Chrome's V8 JavaScript sandbox affects Google Chrome versions prior to 147.0.7727.55 through a type confusion vulnerability. Attackers can execute arbitrary code by convincing users to visit a malicious webpage, requiring no authentication. Vendor-released patch available (Chrome 147.0.7727.55). No public exploit identified at time of analysis, with EPSS probability at 0.04% (11th percentile) indicating low observed exploitation likelihood despite high CVSS score of 8.8.

Technical ContextAI

The vulnerability exists in V8, Google Chrome's open-source JavaScript and WebAssembly engine written in C++. Type confusion (CWE-843) occurs when code incorrectly assumes an object's type, allowing memory to be interpreted as a different type than intended. In V8's case, this typically happens during JIT compilation or object manipulation where type checks fail or are bypassed. The vulnerability is sandboxed, meaning successful exploitation grants code execution within Chrome's renderer process security boundary rather than full system compromise. The CPE identifier cpe:2.3:a:google:chrome applies to all Chrome installations across Windows, macOS, Linux, and ChromeOS platforms. Type confusion vulnerabilities in V8 have historically enabled sandbox escapes when chained with additional vulnerabilities, though this specific CVE is rated for sandbox-internal execution only.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately through the built-in update mechanism (Settings > About Chrome) or by downloading the latest version from https://www.google.com/chrome/. Chrome's automatic update feature should deploy this patch within days for most users, but enterprise environments using managed deployments should prioritize distribution through their software management systems. Verify successful update by navigating to chrome://settings/help and confirming version number 147.0.7727.55 or higher. No effective workarounds exist for this V8 engine vulnerability short of disabling JavaScript entirely, which breaks modern web functionality. Organizations unable to patch immediately should implement defense-in-depth controls including network segmentation, user awareness training about suspicious websites, and enhanced monitoring for anomalous Chrome process behavior. Full advisory and technical details available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.