What is the CVSS score of CVE-2026-5908?

CVE-2026-5908 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-5908?

CVE-2026-5908 is a high-severity integer overflow vulnerability in Google Chrome's Media component that enables arbitrary code execution when users open malicious video files.. A patch is available.

How to fix or mitigate CVE-2026-5908?

Within 24 hours: Identify all Chrome deployments across endpoints and document current versions using endpoint management tools. Within 7 days: Deploy Chrome version 147.0.7727.55 or later to 100% of managed endpoints; prioritize systems with access to sensitive data and users with external email access. Within 30 days: Verify patch deployment completion, update security baselines to block older Chrome versions, and conduct end-user awareness training on not opening unsolicited video files from unknown sources.

Google CVE-2026-5908

EUVD-2026-20736 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-pwvq-679h-c42j

Buffer Overflow Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20736

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

AnalysisAI

Integer overflow in Google Chrome's Media component allows remote attackers to trigger heap corruption via specially crafted video files. Affects Chrome versions prior to 147.0.7727.55. Attack requires user interaction (opening malicious video file) but no authentication. Successful exploitation enables arbitrary code execution with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis. Chromium project rates severity as Low despite CVSS 8.8 score.

Technical ContextAI

Integer overflow (CWE-472) in Chrome's Media subsystem fails to validate video file parameters, allowing heap memory corruption. CVSS vector AV:N/AC:L/PR:N/UI:R indicates network-based delivery requiring user interaction but no privileges. CPE cpe:2.3:a:google:chrome applies to all platforms. Root cause traced to Chromium issue 485115554.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Users must immediately upgrade via browser's built-in update mechanism (Settings > About Chrome) or download current stable release from official channels. Update addresses integer overflow through input validation hardening in Media component. Enterprise deployments should prioritize patch distribution through managed update infrastructure. No workaround exists; upgrade is mandatory. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Technical details: https://issues.chromium.org/issues/485115554. EPSS score 0.03% indicates low observed exploitation activity.