What is the CVSS score of CVE-2026-5866?

CVE-2026-5866 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5866?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the Media component that allows unauthenticated attackers to execute arbitrary code through malicious…. A patch is available.

How to fix or mitigate CVE-2026-5866?

Within 24 hours: Identify all Chrome deployments across the organization and verify current versions. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to all affected systems via your enterprise deployment mechanism (Google Admin Console, SCCM, Jamf, etc.). Within 30 days: Validate 100% remediation through endpoint inventory tools and implement browser update policies to prevent version drift.

Google CVE-2026-5866

EUVD-2026-20663 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-42f8-mjwj-phf3

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20663

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome Media component (versions prior to 147.0.7727.55) enables unauthenticated attackers to execute arbitrary code within Chrome's sandbox via specially crafted HTML pages. Exploitation requires user interaction to visit a malicious site. The use-after-free memory corruption vulnerability achieves high confidentiality, integrity, and availability impact within the sandboxed environment. No public exploit identified at time of analysis.

Technical ContextAI

CWE-416 use-after-free condition in Chrome's Media subsystem allows memory manipulation after deallocation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-exploitable, low-complexity attack requiring no authentication but user interaction. Sandbox containment limits system-level impact despite high CVSS base score of 8.8.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Users must immediately update via Chrome's built-in updater (Settings > About Chrome) or download from official channels. Enterprise deployments should prioritize rapid deployment through managed update mechanisms. No effective workaround exists; the Media component cannot be safely disabled without breaking core browser functionality. Verify installation of 147.0.7727.55 or later. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Chromium issue tracker: https://issues.chromium.org/issues/492218537. EPSS score of 0.04% indicates low observed exploitation activity currently.