What is the CVSS score of CVE-2026-5872?

CVE-2026-5872 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5872?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the Blink rendering engine that allows attackers to execute arbitrary code within Chrome's sandbox by…. A patch is available.

How to fix or mitigate CVE-2026-5872?

Within 24 hours: Verify current Chrome version across all endpoints using your mobile device management (MDM) or endpoint detection and response (EDR) tools and confirm patch availability in your deployment channels. Within 7 days: Deploy Chrome 147.0.7727.55 or later to 100% of managed endpoints through automated update mechanisms; prioritize high-risk user populations (developers, research, external-facing roles). Within 30 days: Audit and validate patch compliance across all Chrome installations and document deployment completion.

Google CVE-2026-5872

EUVD-2026-20675 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-q568-5559-56w7

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 13:22 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20675

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine (versions prior to 147.0.7727.55) allows unauthenticated attackers to execute arbitrary code within Chrome's sandbox by delivering a malicious HTML page that triggers a use-after-free vulnerability. While rated High severity (CVSS 8.8) due to complete confidentiality/integrity/availability impact, EPSS scoring places exploitation probability at only 4% (11th percentile), indicating low observed targeting in the wild. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept identified at time of analysis. Vendor-released patch available in Chrome 147.0.7727.55.

Technical ContextAI

This vulnerability affects the Blink rendering engine, Google's browser rendering component responsible for parsing and executing HTML, CSS, and JavaScript. The root cause is CWE-416 (Use After Free), a memory corruption class where code attempts to access a memory location after it has been freed. In Blink's complex object lifecycle management during page rendering, certain DOM manipulation sequences can trigger premature deallocation of objects that are still referenced. When the freed memory is later accessed during rendering or JavaScript execution, attackers controlling page content can manipulate the freed memory state to redirect execution flow. The CPE identifier (cpe:2.3:a:google:chrome) confirms this affects the Chrome browser application across all supported platforms. Use-after-free vulnerabilities in browser engines are particularly critical because they bridge the gap between web content (untrusted input) and native code execution, though Chrome's multi-process sandbox architecture limits initial impact to the renderer process.

RemediationAI

Immediate remediation requires upgrading Google Chrome to version 147.0.7727.55 or later, which contains the security fix for this use-after-free vulnerability. Chrome's built-in auto-update mechanism typically deploys patches within 24-48 hours for most users, but organizations should verify deployment through enterprise management consoles or chrome://settings/help. For enterprise environments using Chrome Browser Cloud Management or group policy, push version 147.0.7727.55 through centralized update mechanisms. Full remediation guidance is available in the official Chrome Stable Channel update announcement at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. No effective workarounds exist for browser-based vulnerabilities beyond restricting web access to trusted sites, which is generally impractical. Chromium-based browsers (Edge, Opera, Brave) may require separate vendor patches addressing the same Blink engine vulnerability.