What is the CVSS score of CVE-2026-5877?

CVE-2026-5877 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2026-5877?

Chrome versions prior to 147.0.7727.55 contain a high-severity remote code execution vulnerability in the navigation component that allows attackers to execute arbitrary code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-5877?

Within 24 hours: Identify all Chrome deployments in the environment and confirm current versions via endpoint management tools. Within 7 days: Deploy Chrome 147.0.7727.55 or later to all endpoints via your standard patch management process; enable automatic updates where possible to ensure continuous protection. Within 30 days: Verify 100% deployment completion through vulnerability scanning and audit logs.

Chrome CVE-2026-5877

EUVD-2026-20683 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-68f9-j542-jmrp

Denial Of Service RCE Google Memory Corruption Use After Free Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:28 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20683

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution within Chrome's sandbox affects all versions prior to 147.0.7727.55 through a use-after-free vulnerability in the browser's navigation component. Remote attackers can execute arbitrary code by delivering a specially crafted HTML page that triggers memory corruption when a user visits the malicious site. EPSS probability of 0.04% indicates low observed exploitation activity, and no CISA KEV listing confirms this is not confirmed actively exploited at time of analysis. Google has released patches in Chrome 147.0.7727.55.

Technical ContextAI

This vulnerability exploits a use-after-free condition (CWE-416) in Google Chrome's Navigation subsystem, which manages page loading, frame navigation, and browser history. Use-after-free vulnerabilities occur when the browser attempts to access memory that has already been deallocated, creating a window where an attacker can manipulate memory pointers to redirect execution flow. The Navigation component is a critical part of Chrome's multi-process architecture, handling cross-origin navigation security boundaries and process lifecycle management. While Chrome's sandbox architecture limits the impact of arbitrary code execution by restricting system access, successful exploitation still allows attackers to compromise browser processes, potentially accessing user data within the browser context, manipulating rendered content, or chaining with sandbox escape vulnerabilities. The affected product per CPE is cpe:2.3:a:google:chrome with all versions prior to 147.0.7727.55 vulnerable across Windows, macOS, and Linux platforms.

RemediationAI

Upgrade Google Chrome to version 147.0.7727.55 or later immediately through the browser's built-in update mechanism (Settings > About Chrome) or by downloading the latest stable release from google.com/chrome. Chrome's automatic update feature will deploy this patch to most users within days of release. Enterprise deployments using managed Chrome installations should prioritize distribution of version 147.0.7727.55 through their software deployment systems. No workarounds are available as the vulnerability exists in core navigation functionality that cannot be disabled without breaking browser operation. Full vendor advisory with release notes available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.