What is the CVSS score of CVE-2026-5871?

CVE-2026-5871 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5871?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-5871?

Within 24 hours: Enable automatic Chrome updates in your organization or manually verify all endpoints are running Chrome 147.0.7727.55 or later; notify users to restart browsers. Within 7 days: Conduct a full inventory of Chrome installations across all endpoints and confirm 100% deployment of patched version; review browser security policies to enforce auto-updates organization-wide. Within 30 days: Implement browser isolation or sandboxing technology for high-risk users; audit logs for any suspicious Chrome process behavior or sandboxed script execution prior to patch deployment.

Google CVE-2026-5871

EUVD-2026-20673 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-08 Chrome

GHSA-6p79-xrpj-wmp3

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 13:22 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20673

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 147.0.7727.55 allows unauthenticated attackers to execute arbitrary code within the browser sandbox via a maliciously crafted HTML page exploiting a type confusion vulnerability in the V8 JavaScript engine. With CVSS 8.8 (High), network-based attack vector requiring only user interaction, and available vendor patch, this represents a significant but contained threat. EPSS score of 0.04% (11th percentile) indicates low observed exploitation probability, and no active exploitation or public POC is identified at time of analysis. The sandbox containment limits initial impact severity compared to full system compromise.

Technical ContextAI

V8 is Google's open-source high-performance JavaScript and WebAssembly engine used in Chrome and Chromium-based browsers. Type confusion (CWE-843) occurs when code accesses a resource using an incompatible type, leading to memory corruption. In V8's context, this typically involves the just-in-time (JIT) compiler or object model incorrectly handling type assumptions during optimization passes, allowing attackers to violate type safety guarantees. When exploited, type confusion can enable arbitrary read/write primitives in the renderer process memory space. The vulnerability affects the CPE a:google:chrome product line, specifically all versions before the patched release 147.0.7727.55. While execution occurs within Chrome's sandbox architecture (a defense-in-depth mechanism isolating renderer processes), successful exploitation still grants attackers code execution capabilities within that constrained environment, which can be chained with sandbox escape techniques.

RemediationAI

Vendor-released patch: Chrome version 147.0.7727.55 and later versions contain the fix for this V8 type confusion vulnerability. Users should immediately update to Chrome 147.0.7727.55 or newer through the browser's built-in update mechanism (chrome://settings/help) or by downloading the latest stable release from google.com/chrome. Enterprise environments should deploy the patched version through existing software distribution channels and verify successful installation across all endpoints. Chrome's automatic update feature typically applies security patches within days of release for consumer installations. Organizations using Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should consult their respective vendors for patch timelines as these browsers integrate upstream Chromium security fixes on varying schedules. No effective workarounds exist beyond disabling JavaScript entirely, which breaks modern web functionality. Complete advisory details are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and organizations should reference https://issues.chromium.org/issues/495679730 for technical implementation details.