What is the CVSS score of CVE-2026-5909?

CVE-2026-5909 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-5909?

CVE-2026-5909 is a critical integer overflow vulnerability in Google Chrome's Media component affecting versions below 147.0.7727.55 that allows unauthenticated attackers to execute arbitrary code or…. A patch is available.

How to fix or mitigate CVE-2026-5909?

Within 24 hours: Identify all Chrome instances across the organization and audit current versions using asset management tools. Within 7 days: Deploy Chrome version 147.0.7727.55 or later across all desktop platforms via your existing patch management system; configure auto-update policies to enforce immediate upgrades. Within 30 days: Conduct user awareness training on risks of opening untrusted video files and implement content filtering policies to restrict video sources where feasible.

Google CVE-2026-5909

EUVD-2026-20738 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-4cv7-w26g-hfm8

Buffer Overflow Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20738

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

AnalysisAI

Integer overflow in Google Chrome's Media component enables remote heap corruption through malicious video files. Affects Chrome versions prior to 147.0.7727.55 on all desktop platforms. Unauthenticated attackers can achieve arbitrary code execution, data theft, or denial of service by convincing users to open specially crafted video content. CVSS 8.8 severity reflects network-based attack requiring user interaction. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS <1%).

Technical ContextAI

CWE-472 integer overflow in Media subsystem's video processing logic triggers heap memory corruption. Unauthenticated network vector (CVSS AV:N/PR:N) exploitable through browser rendering pipeline when parsing malformed video file structures. Chromium-assigned Low severity contrasts with CVSS 8.8 High rating, suggesting limited practical exploitability despite theoretical impact scope.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Immediate upgrade mandatory via Chrome's built-in updater (Settings > About Chrome) or direct download from https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Enterprise deployments should push 147.0.7727.55+ through managed update channels within 72 hours. No effective workaround exists; mitigation requires patching. Until upgrade completes, disable automatic video preview features and avoid opening untrusted video files. Chromium issue tracker: https://issues.chromium.org/issues/485203821. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html