What is the CVSS score of CVE-2026-5915?

CVE-2026-5915 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome are affected by CVE-2026-5915?

Google Chrome WebML component contains a memory corruption vulnerability (CVE-2026-5915) affecting versions before 147.0.7727.55 that could allow attackers to execute code or crash the browser…. A patch is available.

How to fix or mitigate CVE-2026-5915?

Within 24 hours: Inventory all Chrome installations across managed endpoints and identify current versions. Within 7 days: Deploy Chrome version 147.0.7727.55 or later via your endpoint management system to all machines; prioritize user-facing workstations and kiosk systems. Within 30 days: Verify 100% deployment compliance through vulnerability scanning; confirm no devices remain on versions prior to 147.0.7727.55.

Chrome CVE-2026-5915

EUVD-2026-20750 HIGH

Improper Input Validation (CWE-20)

2026-04-08 Chrome

GHSA-88qr-f9fq-422w

Google Information Disclosure Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20750

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.1

DescriptionCVE.org

Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory write in Google Chrome's WebML component (versions prior to 147.0.7727.55) allows remote attackers to corrupt memory via malicious HTML pages, enabling potential code execution or denial of service. Exploitation requires user interaction to visit a crafted webpage. CVSS 8.1 severity reflects unauthenticated network-based attack with high integrity and availability impact. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.04%).

Technical ContextAI

Root cause is insufficient input validation (CWE-20) in WebML's HTML parsing logic, allowing untrusted web content to trigger writes beyond allocated buffer boundaries. Memory corruption vulnerability enables potential control flow hijacking despite Chromium's low internal severity classification. Affects Google Chrome CPE 2.3:a:google:chrome prior to patched release.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Users must upgrade immediately via browser auto-update or manual download from official channels. Enterprise deployments should prioritize patch distribution through managed update systems. Verify installation by navigating to chrome://settings/help and confirming version 147.0.7727.55 or later. No workarounds exist; exploitation requires only webpage visit, making patching the sole effective mitigation. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Technical details: https://issues.chromium.org/issues/494341335. Additional context: https://nvd.nist.gov/vuln/detail/CVE-2026-5915.