CVE-2026-5866

| EUVD-2026-20663 HIGH
2026-04-08 Chrome GHSA-42f8-mjwj-phf3
8.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch Released
Apr 08, 2026 - 23:32 nvd
Patch available
Analysis Generated
Apr 08, 2026 - 22:01 vuln.today
EUVD ID Assigned
Apr 08, 2026 - 22:01 euvd
EUVD-2026-20663
CVE Published
Apr 08, 2026 - 21:20 nvd
HIGH 8.8

Tags

Google RCE Memory Corruption Denial Of Service Use After Free

Description

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

Remote code execution in Google Chrome Media component (versions prior to 147.0.7727.55) enables unauthenticated attackers to execute arbitrary code within Chrome's sandbox via specially crafted HTML pages. Exploitation requires user interaction to visit a malicious site. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all Chrome deployments across the organization and verify current versions. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to all affected systems via your enterprise deployment mechanism (Google Admin Console, SCCM, Jamf, etc.). …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +44
POC: 0

Share

CVE-2026-5866 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy