Cyber Posture

CVE-2026-5865

High

Published: 08 April 2026

Published
08 April 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of the V8 type confusion flaw through application of the Chrome update to version 147.0.7727.55 or later.

SI-16 Memory Protection partial match
prevent

Implements memory protections like ASLR and DEP that mitigate exploitation of type confusion vulnerabilities leading to arbitrary code execution.

SC-18 Mobile Code partial match
prevent

Establishes controls and policies for mobile code such as JavaScript in crafted HTML pages that trigger the V8 type confusion vulnerability.

Security SummaryAI

CVE-2026-5865 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine within Google Chrome prior to version 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security.

A remote attacker can exploit this vulnerability by tricking a user into visiting a crafted HTML page, leading to arbitrary code execution inside the Chrome sandbox. The attack requires user interaction but no privileges, enabling high-impact confidentiality, integrity, and availability violations within the browser's scope.

Mitigation is available via the stable channel update for desktop Chrome, as announced in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/491884710. Users should update to version 147.0.7727.55 or later.

Details

CWE(s)
CWE-843

Affected Products

google
chrome
≤ 147.0.7727.55

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Type confusion in Chrome's V8 engine exploited via crafted HTML page enables drive-by compromise (T1189) and exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References