What is the CVSS score of CVE-2026-5904?

CVE-2026-5904 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome are affected by CVE-2026-5904?

CVE-2026-5904 is a high-severity vulnerability in Google Chrome's V8 JavaScript engine that could allow remote code execution if users are tricked into installing a malicious extension.. A patch is available.

How to fix or mitigate CVE-2026-5904?

Within 24 hours: Confirm Chrome version inventory across the organization and identify systems running versions prior to 147.0.7727.55. Within 7 days: Deploy Chrome version 147.0.7727.55 or later through your standard patch management process; prioritize systems where users have administrative privileges to install extensions. Within 30 days: Conduct user awareness training emphasizing the risks of installing unverified browser extensions, and review extension policies to restrict installation to approved corporate applications only.

Chrome CVE-2026-5904

EUVD-2026-20728 HIGH

Use After Free (CWE-416)

2026-04-08 Chrome

GHSA-2h64-4pg7-rq8p

Denial Of Service Use After Free Google Memory Corruption Red Hat Suse Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:28 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

8.8 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20728

CVE Published

Apr 08, 2026 - 21:21 nvd

N/A

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Heap corruption via malicious Chrome extension exploits use-after-free flaw in V8 JavaScript engine, affecting Chrome versions prior to 147.0.7727.55. Attacker must convince user to install a crafted extension to achieve potential remote code execution with high confidentiality, integrity, and availability impact. EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity; no CISA KEV listing or public exploit code identified at time of analysis. Despite high CVSS 8.8

Technical ContextAI

V8 is Google's open-source high-performance JavaScript and WebAssembly engine used in Chrome and Chromium-based browsers. This vulnerability stems from CWE-416 (Use After Free), a memory corruption class where code continues to use a pointer after the memory it references has been freed. In V8's context, this likely occurs during JavaScript object lifecycle management within the extension execution environment. When a malicious Chrome Extension triggers specific code paths, the use-after-free condition allows heap memory to be accessed after deallocation, enabling attackers to corrupt memory structures. The Chrome Extensions API provides extensions with elevated privileges for DOM manipulation, network access, and browser automation - making the extension sandbox a high-value target. Chromium's own security severity rating of 'Low' suggests exploitation requires precise heap manipulation and is not reliably weaponizable, contrasting with the CVSS 8.8 score driven by theoretical post-exploitation impact.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately through Chrome's built-in update mechanism (chrome://settings/help) or by downloading the latest stable release from google.com/chrome. Enterprise administrators should deploy the patched version through managed update channels and verify installation across all endpoints. For Chromium-based browser users (Edge, Brave, Opera), monitor respective vendor advisories for downstream security updates incorporating the V8 fix. As a defense-in-depth measure, organizations should enforce extension whitelisting policies to prevent unauthorized extension installation, reducing attack surface regardless of patch status. Review installed extensions via chrome://extensions and remove any unfamiliar or unnecessary items. No effective workaround exists beyond restricting extension installation permissions through Chrome Enterprise Policy (ExtensionInstallBlocklist). Full advisory and patch details available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.