What is the CVSS score of CVE-2026-5913?

CVE-2026-5913 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome are affected by CVE-2026-5913?

Google Chrome versions before 147.0.7727.55 contain an out-of-bounds read vulnerability in the Blink rendering engine that could allow attackers to expose sensitive memory or crash the browser when…. A patch is available.

How to fix or mitigate CVE-2026-5913?

Within 24 hours: Notify users to update Chrome to version 147.0.7727.55 or later via standard update channels. Within 7 days: Verify update deployment across managed Chrome instances using your device management solution (MDM/EMM); confirm version compliance reporting shows 147.0.7727.55+. Within 30 days: Conduct a spot check of 10% of Chrome installations to confirm patch adoption and document closure in your vulnerability management system.

Chrome CVE-2026-5913

EUVD-2026-20746 HIGH

Out-of-bounds Read (CWE-125)

2026-04-08 Chrome

GHSA-6xwp-952x-4vgf

Buffer Overflow Information Disclosure Google Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

5.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:28 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

8.1 (HIGH)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20746

CVE Published

Apr 08, 2026 - 21:21 nvd

N/A

DescriptionCVE.org

Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds read in Google Chrome's Blink rendering engine (versions prior to 147.0.7727.55) allows remote attackers to disclose sensitive memory contents and trigger denial-of-service via malicious HTML pages. Despite an 8.1 CVSS score, this is rated Chromium security severity 'Low', requires user interaction (visiting a crafted page), has minimal real-world exploitation probability (EPSS 0.03%, 10th percentile), and is not actively exploited (no KEV listing). Vendor-released patch available in Chrome 147.0.7727.55.

Technical ContextAI

This vulnerability resides in Blink, Google Chrome's rendering engine responsible for parsing and displaying HTML content. The CWE-125 classification identifies this as an out-of-bounds read flaw, where the rendering engine attempts to access memory beyond allocated buffer boundaries when processing specially-crafted HTML elements. Unlike out-of-bounds write vulnerabilities, read operations typically cannot directly modify program execution flow but can leak sensitive data from process memory (including passwords, tokens, or ASLR-defeating address information) or cause crashes when accessing invalid memory regions. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms this impacts the Google Chrome browser application across all supported platforms. The Chromium project's 'Low' internal severity rating suggests limited exploitability or impact compared to typical browser sandbox escapes or remote code execution vulnerabilities.

RemediationAI

Immediately upgrade Google Chrome to version 147.0.7727.55 or later via the browser's built-in update mechanism (Settings > About Chrome) or enterprise deployment tools. The vendor-released patch addresses the Blink rendering engine vulnerability and is distributed through Chrome's stable channel as documented at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. For enterprise environments, deploy the fixed version through centralized management platforms (Google Admin Console, SCCM, Intune) and verify installation across all endpoints. Organizations unable to immediately patch should implement compensating controls including web filtering to block known-malicious domains, endpoint detection monitoring for Chrome crash patterns indicating exploitation attempts, and user security awareness training about visiting untrusted websites. Chromium-based third-party browsers should be updated according to their respective vendor advisories once downstream patches incorporating the Blink fix are released. No effective workarounds exist beyond complete browser replacement, as the vulnerability affects core HTML rendering functionality that cannot be safely disabled.