CVE-2026-5873
Published: 08 April 2026
Description
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and patching of software flaws like the out-of-bounds read/write vulnerability in Chrome's V8 engine.
Implements controls to protect against memory exploits such as out-of-bounds reads and writes exploited by crafted HTML pages in this CVE.
Requires scanning for vulnerabilities like CVE-2026-5873 in browsers to identify outdated Chrome versions prior to exploitation.
Security SummaryAI
CVE-2026-5873 is an out-of-bounds read and write vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Chromium rated its security severity as High.
A remote attacker can exploit this vulnerability by crafting an HTML page that triggers the memory corruption when rendered in Chrome, enabling arbitrary code execution confined to the browser's sandbox. The attack requires user interaction, such as visiting a malicious website, but needs no privileges or authentication.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.55 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the associated Chromium issue tracker entry at https://issues.chromium.org/issues/496301615. Security practitioners should prioritize updating affected browsers.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read/write in V8 JavaScript engine exploited via malicious HTML page for sandboxed code execution upon visiting website, directly enabling drive-by compromise (T1189) and exploitation for client execution (T1203).