Cyber Posture

CVE-2026-5883

High

Published: 08 April 2026

Published
08 April 2026
Modified
16 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of the use-after-free vulnerability in Chrome's Media component through patching to version 147.0.7727.55 or later.

SI-16 Memory Protection partial match
prevent

Implements memory protection mechanisms such as ASLR and DEP that mitigate exploitation of use-after-free errors by preventing arbitrary code execution from corrupted memory.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection at system entry points to block or detect code execution attempts from crafted HTML pages exploiting the vulnerability.

Security SummaryAI

CVE-2026-5883 is a use-after-free vulnerability (CWE-416) in the Media component of Google Chrome versions prior to 147.0.7727.55. The flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox via a crafted HTML page. Chromium rates the issue as Medium severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), highlighting its potential for high-impact exploitation despite requiring user interaction.

A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website containing the crafted HTML page. No special privileges are needed, and the attack requires only network access and user interaction, such as loading the page. Successful exploitation enables arbitrary code execution within the sandboxed environment, potentially leading to high confidentiality, integrity, and availability impacts.

Mitigation is addressed in the Google Chrome stable channel update for desktop, detailed at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/482958590. Users should update to Chrome 147.0.7727.55 or later to patch the vulnerability.

Details

CWE(s)
CWE-416

Affected Products

google
chrome
≤ 147.0.7727.55

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

The vulnerability is a use-after-free in Chrome's Media component exploited via a crafted HTML page on a malicious website, enabling drive-by compromise (T1189) and exploitation for client execution (T1203) with user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References