What is the CVSS score of CVE-2026-5879?

CVE-2026-5879 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2026-5879?

Google Chrome versions prior to 147.0.7727.55 on macOS contain a remote code execution vulnerability in the ANGLE graphics layer that allows unauthenticated attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-5879?

Within 24 hours: Notify all macOS users to immediately update Google Chrome to version 147.0.7727.55 or later via Settings > About Google Chrome. Within 7 days: Verify update deployment across all managed macOS endpoints using your MDM solution and confirm Chrome version compliance. Within 30 days: Audit browser version reports to ensure no systems remain on pre-147.0.7727.55 versions, and document remediation completion.

Chrome CVE-2026-5879

EUVD-2026-20685 HIGH

Improper Input Validation (CWE-20)

2026-04-08 Chrome

GHSA-cxxr-98x3-mp4j

Google RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 13:23 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20685

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's ANGLE graphics layer on macOS prior to 147.0.7727.55 allows unauthenticated attackers to execute arbitrary code within the browser's sandbox via malicious HTML pages. The vulnerability stems from insufficient input validation (CWE-20) in ANGLE, Chrome's OpenGL ES implementation layer. While rated 8.8 CVSS due to complete confidentiality/integrity/availability impact, EPSS exploitation probability is low (0.05%, 16th percentile) with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES implementation that translates OpenGL ES API calls to native graphics APIs on different platforms. On macOS, ANGLE serves as the graphics abstraction layer between web content and the underlying Metal/OpenGL frameworks. This vulnerability represents a CWE-20 (Improper Input Validation) flaw where ANGLE fails to adequately sanitize untrusted input from web content before processing graphics operations. The affected component processes HTML-embedded graphics instructions, and insufficient validation allows malicious payloads to bypass expected constraints. While the CPE identifier indicates Chrome broadly, EUVD data confirms the issue is specific to macOS implementations of Chrome versions prior to 147.0.7727.55. The sandbox escape limitation means exploitation results in code execution within Chrome's restricted sandbox environment, not complete system compromise, though this still enables significant capabilities like data exfiltration from the browser context.

RemediationAI

Update Google Chrome on macOS to version 147.0.7727.55 or later immediately. The vendor-released patch addresses the insufficient input validation in ANGLE's graphics processing pipeline. Chrome's automatic update mechanism will deploy this fix to most users within days, but administrators should verify update completion through chrome://settings/help. For enterprise environments using managed Chrome deployments, force update policies to ensure rapid deployment across macOS endpoints. The official stable channel update advisory at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html provides full release notes and deployment guidance. No effective workarounds exist beyond completely disabling JavaScript and WebGL rendering, which breaks core web functionality. Organizations unable to immediately patch should implement defense-in-depth controls including network-level blocking of known-malicious domains and user awareness training about visiting untrusted websites until patching completes. Monitor the Chromium issue tracker at issues.chromium.org/issues/40073848 for additional technical remediation details and potential subsequent fixes.