What is the CVSS score of CVE-2026-5893?

CVE-2026-5893 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5893?

Yes, a patch is available for CVE-2026-5893. Update the affected software to the latest version immediately.

Google CVE-2026-5893

EUVD-2026-20713 MEDIUM

Race Condition (CWE-362)

2026-04-08 Chrome

GHSA-44vf-4x73-jv4x

Information Disclosure Google Race Condition

6.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

Severity Changed

Apr 13, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 21:22 NVD

7.5 (HIGH) 6.8 (MEDIUM)

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20713

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome prior to 147.0.7727.55 exploits a race condition in the V8 JavaScript engine to corrupt heap memory via crafted HTML, requiring user interaction. The vulnerability affects all Chrome versions below 147.0.7727.55 across all platforms via the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been confirmed at time of analysis, though the Chromium security team rated it medium severity; EPSS scoring at 0.03% (9th percentile) indicates low real-world exploitation probability despite the high CVSS score of 6.8.

Technical ContextAI

The vulnerability resides in V8, Google's high-performance JavaScript engine embedded in Chrome, which compiles and executes JavaScript in web pages. A race condition (CWE-362) in V8's memory management or garbage collection allows an attacker to create a timing window where heap metadata becomes corrupted. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions. The race condition likely involves concurrent access to shared heap structures without proper synchronization, enabling an attacker to craft a malicious HTML page with carefully timed JavaScript code that exploits the critical section between when an object is freed and when its metadata is reclaimed, resulting in heap corruption that can lead to information disclosure or control flow hijacking.

RemediationAI

Users should immediately update to Google Chrome version 147.0.7727.55 or later, which includes the V8 race condition fix. Chrome's auto-update mechanism will deploy this patch automatically on most systems; users can manually check for updates via Chrome menu > About Google Chrome. No documented workarounds exist for this vulnerability; the only mitigation is to upgrade. Vendors and enterprise administrators should prioritize deployment given the network-accessible vector, even though practical exploitation likelihood is low per EPSS data. Further details are available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.