What is the CVSS score of CVE-2026-5874?

CVE-2026-5874 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5874?

Google Chrome versions prior to 147.0.7727.55 contain a critical use-after-free vulnerability in the PrivateAI component that enables sandbox escape through social engineering, potentially allowing…. A patch is available.

How to fix or mitigate CVE-2026-5874?

Within 24 hours: Inventory Chrome installations across the organization and identify version numbers below 147.0.7727.55. Within 7 days: Deploy Chrome version 147.0.7727.55 or later via managed updates (MDM/SCCM for enterprise environments; auto-update for consumer). Within 30 days: Confirm 100% deployment completion through vulnerability scanning and audit logs; document remediation in change management system.

Google CVE-2026-5874

EUVD-2026-20679 CRITICAL

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-gxc3-xj8w-g58j

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20679

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free vulnerability in Google Chrome's PrivateAI component (versions prior to 147.0.7727.55) enables sandbox escape when remote attackers socially engineer victims into performing specific UI interactions with malicious HTML pages. Exploitation requires user engagement with attacker-controlled content but no authentication. CVSS 9.6 critical severity reflects potential for complete compromise of confidentiality, integrity, and availability with scope change indicating sandbox boundary violation. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.03%).

Technical ContextAI

CWE-416 use-after-free memory corruption in PrivateAI component. Vulnerability triggers when freed memory is accessed after specific UI gesture sequences, allowing arbitrary code execution outside Chrome sandbox. Attack vector requires network delivery (AV:N) with low complexity (AC:L) but mandatory user interaction (UI:R). Scope change (S:C) indicates compromise extends beyond vulnerable component's security context.

RemediationAI

Vendor-released patch: Chrome 147.0.7727.55. Immediately upgrade to Chrome 147.0.7727.55 or later through automatic updates or manual installation from official channels. Verify installation by navigating to chrome://settings/help. Organizations should deploy updated version via enterprise management tools. Users unable to patch immediately should disable JavaScript for untrusted sites and avoid clicking unfamiliar UI elements in web content until upgrade completes. No effective workaround exists for full mitigation; upgrade is mandatory. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html Technical details: https://issues.chromium.org/issues/485397279