What is the CVSS score of CVE-2026-5870?

CVE-2026-5870 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5870?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the Skia graphics library that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-5870?

Within 24 hours: Inventory Chrome installations across the organization and identify devices running versions prior to 147.0.7727.55. Within 7 days: Deploy Chrome 147.0.7727.55 or later through your organization's patch management system and verify deployment completion. Within 30 days: Conduct spot-check audits on 10-15% of workstations to confirm patch application and establish recurring Chrome version compliance monitoring.

Chrome CVE-2026-5870

EUVD-2026-20671 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-7vch-9rmg-wjrj

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:27 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20671

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Skia graphics library (versions prior to 147.0.7727.55) allows remote attackers to execute arbitrary code within the browser's sandbox via specially crafted HTML pages exploiting an integer overflow vulnerability. Google patched this high-severity flaw in Chrome 147.0.7727.55 released April 2026. No active exploitation confirmed (not on CISA KEV), with low EPSS score (0.04%, 11th percentile) indicating minimal observed exploitation activity. Exploitation requires user interaction (visiting malicious webpage) but no authentication, making it viable for drive-by attacks against unpatched Chrome installations.

Technical ContextAI

This vulnerability affects Skia, Google Chrome's open-source 2D graphics rendering engine responsible for drawing text, shapes, and images across the browser interface. The integer overflow (CWE-472) occurs when arithmetic operations on integer values produce results exceeding the maximum representable value, causing wrap-around that can lead to buffer overflows, incorrect memory allocations, or logic errors. In Skia's case, the integer overflow during graphics processing operations allows attackers to corrupt memory within the rendering pipeline. While Chrome's multi-process architecture confines exploitation to the renderer sandbox (S:U in CVSS vector indicates unchanged scope), successful exploitation still achieves arbitrary code execution with complete compromise of confidentiality, integrity, and availability within that sandboxed context. The vulnerability affects all Chrome installations on desktop platforms (Windows, macOS, Linux) prior to version 147.0.7727.55, as indicated by the CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with version ceiling at 147.0.7727.55.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later, released in April 2026, which contains the fix for the Skia integer overflow vulnerability. Chrome's automatic update mechanism will deploy this patch to most installations within days of release-users can verify their version and manually trigger updates via chrome://settings/help. For enterprise environments using managed Chrome deployments, administrators should prioritize distribution of version 147.0.7727.55 through existing patch management workflows, ensuring update policies permit timely security releases. The vendor advisory is available at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, with technical details under Chromium issue tracker ID 495534710. No workarounds exist for this vulnerability; patching is the sole mitigation. Organizations unable to immediately deploy the update should implement compensating controls such as restricting browser access to trusted websites only, though this provides limited protection against social engineering attacks.