Google CVE-2026-5872

The victim must open a crafted HTML page in Google Chrome prior to version 147.0.7727.55. Remote unauthenticated attacker requires user interaction (victim visits malicious webpage). Exploitation occurs within Chrome's sandbox environment.

Real-world risk assessment reveals a nuanced threat profile. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) indicates network-based exploitation with low complexity requiring no authentication but necessitating user interaction (visiting a malicious page), yielding high impact across confidentiality, integrity, and availability within the sandboxed scope (S:U). However, the EPSS score of 0.04% (11th percentile) suggests extremely low observed exploitation activity in the wild, likely because Chrome's auto-update mechanism rapidly deploys patches to the user base, narrowing the vulnerability window. The absence of CISA KEV listing confirms no government-observed active exploitation, and no public proof-of-concept code has been identified. From an SSVC framework perspective: exploitation status is None (no evidence), automatable is No (requires social engineering to lure users), and technical impact is Partial (sandbox escape would require chaining with additional vulnerabilities). This represents a theoretically serious vulnerability with practical exploitation barriers - the high CVSS score reflects worst-case sandboxed impact, but the low EPSS and rapid patch deployment significantly reduce actual organizational risk compared to other 8.8-rated vulnerabilities. Priority should focus on ensuring Chrome auto-update compliance rather than emergency patching procedures.

An attacker hosts a malicious website or compromises a legitimate site to serve a weaponized HTML page containing crafted DOM manipulation sequences. When a user visits the page with a vulnerable Chrome version, JavaScript triggers specific object lifecycle operations that cause Blink to free memory while maintaining dangling pointers. The attacker's payload manipulates the freed memory region to redirect code execution within the Chrome renderer sandbox, potentially achieving arbitrary code execution within that isolated process. While public proof-of-concept code is not available, the technical details in Chromium issue 496281816 could enable skilled attackers to reproduce the vulnerability.