What is the CVSS score of CVE-2026-5884?

CVE-2026-5884 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by CVE-2026-5884?

Google Chrome versions prior to 147.0.7727.55 contain a remote code execution vulnerability in the Media component that allows attackers to escape the renderer sandbox and achieve arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-5884?

Within 24 hours: Identify Chrome versions in use across the organization via endpoint management tools and confirm deployment capability. Within 7 days: Deploy Chrome 147.0.7727.55 or later to all user endpoints via your standard patch management process (Group Policy, MDM, or Chrome update mechanisms); verify successful updates on at least 95% of devices. Within 30 days: Achieve 100% deployment coverage and conduct spot-check audits to confirm no systems remain on pre-147.0.7727.55 versions.

Google CVE-2026-5884

EUVD-2026-20695 HIGH

Improper Input Validation (CWE-20)

2026-04-08 Chrome

GHSA-w6c2-hh29-88fc

RCE Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 13:23 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20695

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome prior to 147.0.7727.55 allows attackers to escape renderer sandbox via malicious HTML page. A remote attacker who has already compromised the renderer process can achieve arbitrary code execution within the sandbox through insufficient input validation in Chrome's Media component. Requires user interaction (visiting crafted page). EPSS score of 0.05% (16th percentile) indicates low observed exploitation probability; no confirmed active exploitation (not in CISA KEV). Vendor patch released in Chrome 147.0.7727.55.

Technical ContextAI

This vulnerability stems from CWE-20 (Improper Input Validation) in Google Chrome's Media handling subsystem. Chrome's multi-process architecture isolates web content rendering in sandboxed renderer processes to contain exploits. This flaw allows an attacker who has already achieved renderer compromise (through a separate exploit or vulnerability) to escalate privileges within the sandbox environment by sending maliciously crafted input to the Media component. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-based attack with low complexity but requires user interaction. The vulnerability affects Chrome's media processing pipeline, which handles audio/video playback, streaming protocols, and codec operations. Insufficient validation of untrusted data from web content allows attacker-controlled input to trigger memory corruption or logic errors leading to code execution. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects the Chrome browser application across platforms.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. Chrome's automatic update mechanism will deploy this patch to most users within days, but manual verification is recommended by navigating to Settings > About Chrome to force update check and restart. Enterprise deployments using managed Chrome should push version 147.0.7727.55 through group policy or mobile device management systems. Chromium-based browser users (Edge, Brave, Opera, Vivaldi) should monitor their respective vendor security advisories for patched versions incorporating this Chromium upstream fix. No effective workarounds exist beyond disabling JavaScript (which breaks most web functionality) or restricting browsing to trusted sites only. Full advisory and technical details available at chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and Chromium bug tracker issues/484547633.