What is the CVSS score of CVE-2026-5869?

CVE-2026-5869 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5869?

Yes, a patch is available for CVE-2026-5869. Update the affected software to the latest version immediately.

Google CVE-2026-5869

EUVD-2026-20669 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-08 Chrome

GHSA-pvxc-vj6p-fp82

Buffer Overflow Google Heap Overflow

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 14, 2026 - 13:22 NVD

LOW MEDIUM

CVSS changed

Apr 14, 2026 - 13:22 NVD

3.1 (LOW) 4.3 (MEDIUM)

Severity Changed

Apr 13, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Apr 13, 2026 - 15:22 NVD

6.5 (MEDIUM) 3.1 (LOW)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20669

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

MEDIUM 6.5

DescriptionCVE.org

Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in WebML (a web markup language component) in Google Chrome prior to version 147.0.7727.55 allows remote attackers to obtain potentially sensitive information from process memory by serving a crafted HTML page. The vulnerability requires no user authentication and can be triggered through normal web browsing, though exploitation has a low probability (EPSS 0.03%) and no public exploit code has been identified.

Technical ContextAI

The vulnerability is a heap buffer overflow (CWE-122) in the WebML processing component of Chromium/Chrome's rendering engine. When parsing specially crafted HTML containing malformed WebML elements, the heap buffer handling mechanism fails to properly validate bounds, causing a write or read operation to exceed allocated memory. This memory corruption can leak adjacent heap data containing sensitive information such as authentication tokens, encryption keys, or other process memory contents. The WebML component is a renderer-level feature affecting all Chrome users on all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Users should upgrade Google Chrome to version 147.0.7727.55 or later immediately. Chrome's auto-update feature will deliver this patch automatically on next browser restart for most users, but manual verification can be performed via Settings > About > Chrome to confirm the installed version matches 147.0.7727.55 or higher. No workarounds are available short of disabling untrusted web content or switching browsers; the patch address is the only remediation. Detailed patch information is available in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html) and the Chromium issue tracker (https://issues.chromium.org/issues/493708165).