What is the CVSS score of CVE-2026-5910?

CVE-2026-5910 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-5910?

Google Chrome versions prior to 147.0.7727.55 contain an integer overflow vulnerability in media handling that allows remote attackers to execute arbitrary code through crafted video files, requiring…. A patch is available.

How to fix or mitigate CVE-2026-5910?

Within 24 hours: Notify all users to update Chrome immediately to version 147.0.7727.55 or later via auto-update or manual installation. Within 7 days: Verify update deployment through endpoint management tools and confirm no systems remain on vulnerable versions. Within 30 days: Conduct audit of Chrome versions organization-wide and implement mandatory auto-update policies if not already enforced.

Google CVE-2026-5910

EUVD-2026-20740 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-g284-h8h3-hv83

Buffer Overflow Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20740

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

AnalysisAI

Integer overflow in Google Chrome's media handling (versions prior to 147.0.7727.55) enables remote attackers to trigger heap corruption through specially crafted video files, achieving potential arbitrary code execution with high confidentiality, integrity, and availability impact. Attack requires user interaction to open malicious media content. Exploitation is unauthenticated (network-accessible). No public exploit identified at time of analysis. Classified as low severity by Chromium project despite CVSS 8.8 rating.

Technical ContextAI

CWE-472 integer overflow in Chrome's media processing pipeline causes heap corruption when parsing video file metadata or frame data. Overflow condition bypasses bounds checks during buffer allocation, enabling attacker-controlled memory corruption. CPE cpe:2.3:a:google:chrome applies to all platforms prior to patched release.

RemediationAI

Vendor-released patch: Google Chrome version 147.0.7727.55 resolves this vulnerability. Users must upgrade immediately via built-in Chrome update mechanism (Settings > About Chrome) or download from official channels. Enterprise deployments should push updates through managed update infrastructure. No workarounds exist; mitigation requires patching. Upstream fix tracked at Chromium issue 485212874. Official advisory available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Organizations unable to patch immediately should implement network-layer restrictions on untrusted video file sources and enforce browser security policies prohibiting automatic media playback.