What is the CVSS score of CVE-2026-5888?

CVE-2026-5888 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5888?

Yes, a patch is available for CVE-2026-5888. Update the affected software to the latest version immediately.

Google CVE-2026-5888

EUVD-2026-20703 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-04-08 Chrome

GHSA-jvch-x2xh-p75v

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

6.5 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20703

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Information disclosure in Google Chrome prior to 147.0.7727.55 allows remote attackers to read sensitive process memory through the WebCodecs API via a crafted HTML page. Exploitation requires user interaction (UI:R) to visit a malicious webpage but grants high-confidence memory access. The vulnerability has low real-world exploitation probability (EPSS 0.03%) despite satisfying network-accessible conditions, likely due to unreliable memory content extraction and WebCodecs' limited practical attack surface in typical user workflows.

Technical ContextAI

The vulnerability stems from an uninitialized memory use (CWE-457) in Google Chrome's WebCodecs implementation, a browser API for audio/video codec operations. Uninitialized memory in browser contexts often contains residual data from freed process memory, including fragments of JavaScript objects, DOM elements, or other sensitive structures. The WebCodecs API, which provides direct access to hardware-accelerated codec operations, can expose this uninitialized state to JavaScript running within the page's security context. The flaw affects Chrome versions prior to 147.0.7727.55, indicating the issue was not present in the 147.0.7727.55 release or later.

RemediationAI

Vendor-released patch: Chrome 147.0.7727.55 or later. Users should update Chrome via Settings > About Chrome, which typically triggers automatic download and installation with a restart prompt. Enterprise administrators can deploy via group policy to Chrome managed devices. No known workarounds exist; the fix requires code-level correction in WebCodecs memory initialization. Refer to Google's advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/486506202 for detailed patch notes.