CVE-2026-5912
Published: 08 April 2026
Description
Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the integer overflow vulnerability by requiring timely remediation through patching Google Chrome to version 147.0.7727.55 or later.
Implements memory protection safeguards like ASLR and DEP that prevent exploitation of the out-of-bounds memory write for arbitrary code execution.
Enforces process isolation via browser sandboxing to confine any successful exploitation within WebRTC to a restricted process environment.
Security SummaryAI
CVE-2026-5912 is an integer overflow vulnerability (CWE-472) in the WebRTC component of Google Chrome prior to version 147.0.7727.55. The flaw enables a remote attacker to perform an out-of-bounds memory write by processing a crafted HTML page. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-04-08.
A remote attacker can exploit this vulnerability without authentication by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Successful exploitation allows arbitrary out-of-bounds memory writes, potentially resulting in high confidentiality, integrity, and availability impacts, including code execution or system compromise within the browser's sandbox.
Mitigation involves updating Google Chrome to version 147.0.7727.55 or later, as announced in the stable channel update for desktop at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional technical details are documented in the Chromium issue tracker at https://issues.chromium.org/issues/486498791, where it is rated as Low severity by Chromium security standards.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in Chrome WebRTC enables out-of-bounds write via crafted HTML page, directly facilitating drive-by compromise (T1189) and client-side exploitation for code execution (T1203).