What is the CVSS score of CVE-2026-5886?

CVE-2026-5886 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-5886?

Google Chrome WebAudio on macOS prior to version 147.0.7727.55 contains an out-of-bounds read vulnerability that allows remote attackers to extract sensitive process memory through crafted HTML…. A patch is available.

How to fix or mitigate CVE-2026-5886?

Within 24 hours: Notify all macOS users to update Chrome to version 147.0.7727.55 or later and verify updates via Settings > About Google Chrome. Within 7 days: Audit Chrome deployment policies; enforce automatic updates for managed devices via Chrome Enterprise policies. Within 30 days: Confirm 100% of macOS fleet has applied the patch and generate a compliance report to security leadership.

Google CVE-2026-5886

EUVD-2026-20700 MEDIUM

Out-of-bounds Read (CWE-125)

2026-04-08 Chrome

Buffer Overflow Information Disclosure Google

5.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 13, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 15:22 NVD

7.5 (HIGH) 5.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20700

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

HIGH 7.5

DescriptionCVE.org

Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in Google Chrome WebAudio (Mac) prior to version 147.0.7727.55 enables remote information disclosure via crafted HTML. Unauthenticated network-based attacker can extract sensitive process memory without user interaction. CVSS 7.5 (High confidentiality impact). No public exploit identified at time of analysis. Low observed exploitation activity (EPSS <1%). Patch available from vendor.

Technical ContextAI

CWE-125 out-of-bounds read in WebAudio subsystem allows memory boundary violations during audio processing. Mac-specific platform implementation flaw enables read access beyond allocated buffer boundaries. CVSS vector AV:N/AC:L/PR:N confirms network-accessible attack surface requiring no authentication or complexity barriers.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Upgrade immediately via chrome://settings/help or download from official Google Chrome channels. This release addresses the out-of-bounds read in WebAudio implementation. No workaround exists; patch deployment is mandatory for Mac users. Verify installation of 147.0.7727.55 or later post-upgrade. Organizations should prioritize deployment given unauthenticated network attack vector despite medium Chromium severity rating. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Technical details: https://issues.chromium.org/issues/485397283