What is the CVSS score of CVE-2026-5873?

CVE-2026-5873 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5873?

Google Chrome versions prior to 147.0.7727.55 contain a critical remote code execution vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code by tricking users into…. A patch is available.

How to fix or mitigate CVE-2026-5873?

Within 24 hours: Verify current Chrome deployment versions across your organization and prepare patch deployment. Within 7 days: Deploy Chrome 147.0.7727.55 or later to all endpoints using your standard patch management process; prioritize systems with high-risk user profiles (developers, administrators, public-facing roles). Within 30 days: Confirm 100% patch compliance through endpoint management tools and conduct follow-up security awareness training on avoiding malicious websites.

Google CVE-2026-5873

EUVD-2026-20678 HIGH

Out-of-bounds Read (CWE-125)

2026-04-08 Chrome

RCE Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 13:22 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20678

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to 147.0.7727.55 allows attackers to execute arbitrary code within the browser sandbox through crafted HTML pages exploiting out-of-bounds read/write conditions in the V8 JavaScript engine. User interaction (visiting a malicious page) is required, but no authentication is needed. With CVSS 8.8 and low EPSS (0.04%, 11th percentile), this represents a high-severity browser vulnerability with limited observed real-world exploitation activity. Patch available in Chrome 147.0.7727.55. No public exploit identified at time of analysis.

Technical ContextAI

This vulnerability affects V8, Google Chrome's open-source JavaScript and WebAssembly engine written in C++. V8 compiles JavaScript to native machine code and handles memory management for script execution. The CWE-125 classification indicates an out-of-bounds read vulnerability, though the description notes both read and write conditions exist, suggesting a compound memory corruption issue. Out-of-bounds memory access in V8 can occur during JIT compilation, object property access, or array operations when bounds checks are improperly optimized or bypassed. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies all Google Chrome versions prior to the fixed release as affected. The sandbox escape limitation is critical-while arbitrary code execution is possible, it remains constrained within Chrome's security sandbox architecture, requiring additional vulnerabilities for full system compromise.

RemediationAI

Upgrade Google Chrome to version 147.0.7727.55 or later immediately. Chrome typically auto-updates within 24-48 hours of release, but users should manually trigger updates by navigating to chrome://settings/help and clicking 'Check for updates' to ensure immediate protection. For enterprise environments using managed Chrome deployments, administrators should push version 147.0.7727.55 through their software distribution systems. No effective workarounds exist for this V8 engine vulnerability short of disabling JavaScript entirely, which would break most web functionality. Organizations unable to immediately patch should consider implementing enhanced web filtering to block known-malicious domains and deploying endpoint detection solutions capable of identifying suspicious browser process behavior. The official vendor advisory with complete patch information is available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional technical details for security researchers are documented in the Chromium bug tracker at https://issues.chromium.org/issues/496301615.