What is the CVSS score of CVE-2026-5867?

CVE-2026-5867 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5867?

Yes, a patch is available for CVE-2026-5867. Update the affected software to the latest version immediately.

Chrome CVE-2026-5867

EUVD-2026-20665 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-08 Chrome

GHSA-3gvp-p32j-pc5m

Google Buffer Overflow Heap Overflow Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 14, 2026 - 13:22 NVD

LOW MEDIUM

CVSS changed

Apr 14, 2026 - 13:22 NVD

3.1 (LOW) 4.3 (MEDIUM)

Severity Changed

Apr 13, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Apr 13, 2026 - 15:22 NVD

6.5 (MEDIUM) 3.1 (LOW)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20665

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

MEDIUM 6.5

DescriptionCVE.org

Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in WebML component of Google Chrome prior to version 147.0.7727.55 allows unauthenticated remote attackers to read sensitive information from process memory via a specially crafted HTML page. The vulnerability requires no user authentication and only user interaction (page visit), with a CVSS score of 6.5 reflecting confidentiality impact and limited availability risk. No public exploit code or active exploitation has been confirmed at time of analysis, though a vendor patch is available.

Technical ContextAI

The vulnerability exists in WebML, a subcomponent of Chrome's rendering engine, and is classified as a heap buffer overflow (CWE-122). Heap buffer overflows occur when code writes data beyond the allocated bounds of a heap-allocated buffer, potentially corrupting adjacent heap structures and allowing attackers to read or corrupt memory. In this case, the vulnerability enables information disclosure-attackers can craft malicious HTML pages that trigger the overflow condition, allowing them to read adjacent heap memory containing potentially sensitive data such as encryption keys, authentication tokens, or other process state. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates network accessibility, low attack complexity, and no privilege requirements, though the UI:N designation in this context reflects that user interaction (visiting a webpage) is required in practice for Chrome's sandbox model.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later. Chrome typically applies security updates automatically upon browser restart; users can force an immediate update by opening Settings > About Chrome, which will trigger update installation if available. Vendor-released patch information is available in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/492668885. Organizations managing Chrome deployments should verify rollout of version 147.0.7727.55 or later across all systems within standard patching windows.