CVE-2026-5915
Published: 08 April 2026
Description
Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of untrusted inputs like crafted HTML pages in WebML to prevent out-of-bounds memory writes.
Implements memory safeguards such as bounds checking and isolation to protect against out-of-bounds memory write exploits.
Requires timely patching of flaws like CVE-2026-5915 by updating Google Chrome to version 147.0.7727.55 or later.
Security SummaryAI
CVE-2026-5915 involves insufficient validation of untrusted input in the WebML component of Google Chrome prior to version 147.0.7727.55. This vulnerability enables a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. It is classified under CWE-20: Improper Input Validation, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), though Chromium rates its security severity as Low.
A remote attacker can exploit this over the network with low attack complexity and no privileges, requiring user interaction such as visiting a malicious webpage. Exploitation results in high-impact integrity and availability violations through the out-of-bounds memory write, with no confidentiality impact.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.55 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/494341335. Security practitioners should prioritize updating affected browsers.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of a client-side browser component (Google Chrome WebML) via a crafted HTML page, directly facilitating Exploitation for Client Execution (T1203).