What is the CVSS score of CVE-2026-5883?

CVE-2026-5883 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-5883?

Google Chrome versions before 147.0.7727.55 contain a use-after-free vulnerability (CVE-2026-5883, CVSS 8.8) allowing attackers to execute code on employee endpoints through socially engineered HTML…. A patch is available.

How to fix or mitigate CVE-2026-5883?

Within 24 hours: Inventory Chrome versions across all endpoints to identify systems running versions prior to 147.0.7727.55, and issue a security alert to end users warning against clicking suspicious links or visiting untrusted sites. Within 7 days: Deploy Google Chrome version 147.0.7727.55 or later organization-wide using your enterprise deployment mechanism (Google Admin Console, SCCM, Jamf, or equivalent), prioritizing staff with high web exposure and external communications roles. Within 30 days: Verify patch deployment completion through endpoint telemetry, audit compliance metrics, and update browser management policies to enforce automatic Chrome updates and reduce future patch lag.

Google Chrome CVE-2026-5883

EUVD-2026-20693 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-px27-v386-gc8q

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N) with no privileges (PR:N) but requiring the victim to visit it (UI:R); renderer-only compromise keeps scope unchanged (S:U) with full renderer C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:10 vuln.today

CVSS changed

Apr 16, 2026 - 16:37 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20693

CVE Published

Apr 08, 2026 - 21:20 cve.org

HIGH 8.8

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionNVD

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed remote code execution in Google Chrome desktop before 147.0.7727.55 stems from a use-after-free in the Media component, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code within the renderer sandbox. Rated 8.8 (High) by CVSS despite Chromium's internal 'Medium' severity, it was reported internally by the Chrome team and is patched, but shows no public exploit identified at time of analysis and an EPSS of just 0.04% (11th percentile), consistent with the SSVC 'Exploitation: none' determination.

Technical ContextAI

The flaw is a CWE-416 Use After Free in Chrome's Media subsystem, the pipeline responsible for decoding and rendering audio/video content (e.g. HTMLMediaElement, media source buffers, and codec handling). Use-after-free bugs arise when a heap object is freed while a dangling pointer still references it; an attacker who controls page content can groom the heap so the freed slot is reoccupied with attacker-controlled data, converting the stale reference into a controlled read/write and ultimately code execution. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome desktop builds prior to 147.0.7727.55 are affected. Notably, the description scopes execution to 'inside a sandbox' - the renderer process sandbox - meaning this bug alone does not yield host compromise without a separate sandbox-escape primitive.

RemediationAI

Vendor-released patch: update Google Chrome to 147.0.7727.55 or later via the stable channel and relaunch the browser to load the new binaries; confirm through chrome://settings/help. Managed fleets should push the update through their update-management tooling and verify enrolled clients report the fixed build. There is no supported configuration-based workaround for a media-parsing use-after-free, so patching is the only reliable fix; as an interim compensating control for unpatched endpoints, restrict browsing of untrusted sites and consider enterprise policies that reduce exposure to hostile media content, accepting that this degrades usability and does not close the bug. Ensure Chromium-based browsers (Edge, Brave, Opera) and embedded Electron runtimes are updated to versions incorporating the same upstream fix. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.