What is the CVSS score of CVE-2026-5907?

CVE-2026-5907 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome are affected by CVE-2026-5907?

Google Chrome versions prior to 147.0.7727.55 contain an out-of-bounds memory read vulnerability in the media subsystem that allows remote attackers to extract sensitive information or crash the…. A patch is available.

How to fix or mitigate CVE-2026-5907?

Within 24 hours: Inventory Chrome deployment versions across endpoints and identify instances below 147.0.7727.55. Within 7 days: Deploy Chrome version 147.0.7727.55 or later via your endpoint management system; prioritize systems handling sensitive data or frequent video consumption. Within 30 days: Validate 100% deployment completion and confirm no instances remain on vulnerable versions through automated scanning.

Chrome CVE-2026-5907

EUVD-2026-20734 HIGH

Out-of-bounds Read (CWE-125)

2026-04-08 Chrome

GHSA-96rx-8295-gjvx

Information Disclosure Buffer Overflow Google Red Hat Suse Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

5.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20734

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.1

DescriptionCVE.org

Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory read in Google Chrome's media subsystem (versions prior to 147.0.7727.55) enables remote attackers to disclose sensitive information and trigger denial-of-service conditions via malicious video files. Exploitation requires user interaction (opening/playing crafted video content). Attack vector is network-based with low complexity and no authentication required. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.03%, 10th percentile).

Technical ContextAI

CWE-125 out-of-bounds read vulnerability stems from insufficient input validation in Chrome's media processing pipeline when parsing video file structures. Affects cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to build 147.0.7727.55. Attack achieves high confidentiality impact through memory disclosure and high availability impact via process crashes, classified low severity by Chromium team despite CVSS 8.1 scoring.

RemediationAI

Vendor-released patch: upgrade to Google Chrome version 147.0.7727.55 or later via automatic update mechanism or manual download from official channels. Organizations should prioritize deployment despite low Chromium severity rating given CVSS 8.1 score and potential for memory disclosure attacks. Verify installation reaches build number 147.0.7727.55 minimum. No effective workarounds exist short of blocking untrusted video file sources at network perimeter or disabling media playback features (operationally impractical). Consult vendor advisory for deployment guidance: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Chromium issue tracker provides technical implementation details: https://issues.chromium.org/issues/484665123.