What is the CVSS score of CVE-2026-5912?

CVE-2026-5912 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-5912?

Google Chrome versions prior to 147.0.7727.55 contain a critical WebRTC integer overflow vulnerability (CVSS 8.8) that allows remote attackers to execute arbitrary code or corrupt data when users…. A patch is available.

How to fix or mitigate CVE-2026-5912?

Within 24 hours: Identify Chrome deployment scope across endpoints using device inventory tools; enable automatic Chrome updates if not already active. Within 7 days: Verify all Chrome instances have auto-updated to version 147.0.7727.55 or later; audit update logs and re-scan any systems still running vulnerable versions. Within 30 days: Conduct post-patching compliance verification; document patch deployment completion and user communication regarding the fix.

Google CVE-2026-5912

EUVD-2026-20744 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-08 Chrome

GHSA-q3h3-jpfc-g5v7

Buffer Overflow Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20744

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Integer overflow in Google Chrome's WebRTC component (versions prior to 147.0.7727.55) enables remote attackers to trigger out-of-bounds memory writes through specially crafted HTML pages. Exploitation requires user interaction (visiting malicious page) but no authentication, potentially allowing arbitrary code execution, data corruption, or information disclosure. Vendor-assigned security severity: Low; CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis.

Technical ContextAI

Root cause: CWE-472 integer overflow in WebRTC media handling logic. Arithmetic overflow enables controlled out-of-bounds write primitive in heap/stack memory regions. Attack vector requires processing attacker-controlled integer values during WebRTC session initialization or media stream processing. CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* affected through version 147.0.7727.54.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Users must immediately upgrade to this version or later through Chrome's built-in updater (Settings > About Chrome) or download from official distribution channels. Enterprise deployments should prioritize patch rollout via managed update infrastructure. No effective workarounds exist; disabling WebRTC via chrome://flags reduces attack surface but breaks legitimate real-time communication features. Verify installation success by navigating to chrome://settings/help. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Technical details: https://issues.chromium.org/issues/486498791. EPSS score 0.03% indicates low observed exploitation activity.