What is the CVSS score of CVE-2026-5868?

CVE-2026-5868 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5868?

Google Chrome for macOS contains a critical heap buffer overflow in the ANGLE graphics layer (CVE-2026-5868) that allows remote code execution within the Chrome sandbox when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-5868?

Within 24 hours: Inventory all macOS systems running Chrome versions prior to 147.0.7727.55 and enable auto-updates if not already active. Within 7 days: Verify Chrome has auto-updated to version 147.0.7727.55 or later across all macOS endpoints; use endpoint management tools to confirm compliance. Within 30 days: Conduct security awareness communication reminding users not to disable Chrome auto-updates and to avoid untrusted websites pending patch verification.

Chrome CVE-2026-5868

EUVD-2026-20667 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-08 Chrome

GHSA-vwj9-ff2w-vvh3

RCE Google Buffer Overflow Heap Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 14:23 vuln.today

CVSS changed

Apr 13, 2026 - 14:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20667

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in Google Chrome for macOS versions prior to 147.0.7727.55 occurs via heap buffer overflow in the ANGLE graphics layer when processing malicious HTML pages. Remote attackers can achieve full compromise of confidentiality, integrity, and availability within Chrome's sandbox by exploiting this CWE-122 heap overflow with low attack complexity and no authentication. EPSS probability is low (0.03%, 10th percentile) with no public exploit identified at time of analysis, indicating limited observed exploitation activity despite the high CVSS score of 8.8.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES implementation that translates WebGL and OpenGL ES calls to platform-specific graphics APIs (Metal on macOS, Direct3D on Windows). This vulnerability stems from a CWE-122 heap-based buffer overflow, where inadequate bounds checking allows writing beyond allocated heap memory boundaries during graphics processing. On macOS specifically, ANGLE interfaces with Metal for GPU acceleration. The heap overflow occurs when parsing specially crafted HTML content that triggers malformed graphics commands, allowing memory corruption in the renderer process. While Chrome's multi-process sandbox architecture confines exploitation to the renderer process and prevents direct system-level compromise, attackers achieving arbitrary code execution within the sandbox can potentially chain this with sandbox escape vulnerabilities for full system access. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms this is specific to the Chrome browser application, with platform-specific impact limited to macOS builds.

RemediationAI

Update Google Chrome on macOS to version 147.0.7727.55 or later immediately. Chrome's built-in auto-update mechanism will deliver this patch automatically for most users within 24-48 hours of release. For enterprise environments using managed Chrome deployments, administrators should verify that auto-updates are enabled and force an update cycle through Google Update or enterprise management tools. Manual updates can be initiated via Chrome menu > Help > About Google Chrome, which checks for and installs the latest stable version. Organizations unable to patch immediately should implement compensating controls including restricting web browsing to trusted sites only, deploying advanced web filtering to block suspicious HTML content, and educating users about risks of visiting untrusted websites. Complete vendor advisory available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. No workarounds exist that fully mitigate the vulnerability while maintaining browser functionality; patching is the only complete remediation. Given Chrome's sandbox architecture, this vulnerability alone does not provide system-level access, but should be prioritized as part of defense-in-depth strategy to prevent chained exploitation scenarios.