CVE-2026-5862
Published: 08 April 2026
Description
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of the V8 implementation flaw in Chrome prior to 147.0.7727.55 to prevent arbitrary code execution inside the sandbox.
Mandates vulnerability scanning and monitoring to detect Chrome installations vulnerable to CVE-2026-5862 and remediate them based on risk assessments.
Facilitates rapid awareness of the Chrome stable channel update for CVE-2026-5862 by receiving and disseminating security advisories and directives.
Security SummaryAI
CVE-2026-5862 is a high-severity vulnerability stemming from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 147.0.7727.55. It enables a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8, reflecting its network accessibility, low attack complexity, lack of required privileges, and high impacts on confidentiality, integrity, and availability.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, such as by clicking a link or loading content. No special privileges are needed, but user interaction is required. Successful exploitation allows arbitrary code execution confined to the sandbox, potentially leading to further compromise if chained with other flaws, though it does not escape the sandbox on its own.
Mitigation is addressed in the Chrome stable channel update announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, which patches the issue in version 147.0.7727.55 and later. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/470566252. Security practitioners should prioritize updating affected Chrome installations to the patched version.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote arbitrary code execution in Chrome browser sandbox via crafted HTML page tricked via malicious website visit or link click, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).