CVE-2026-5275
Published: 01 April 2026
Summary
CVE-2026-5275 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5275 is a heap buffer overflow vulnerability (CWE-122) in the ANGLE graphics component of Google Chrome on macOS, affecting versions prior to 146.0.7680.178. This flaw allows a remote attacker to execute arbitrary code by tricking a user into visiting a crafted HTML page. The vulnerability carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), highlighting its potential for significant impact through network-accessible exploitation with low complexity and no privileges required beyond user interaction.
A remote attacker can exploit this vulnerability by hosting or controlling a malicious HTML page that, when loaded in an affected Chrome browser on macOS, triggers the heap buffer overflow in ANGLE during rendering. This requires the user to interact by visiting the page (UI:R), after which the attacker achieves arbitrary code execution with the privileges of the browser process, potentially leading to high confidentiality, integrity, and availability impacts such as data theft, sandbox escape, or full system compromise.
Mitigation is addressed in the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html, which patches the issue in version 146.0.7680.178 and later. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/489494022. Security practitioners should advise users to update Chrome immediately and consider enterprise deployment policies to enforce automatic updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17784
Vulnerability details
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome ANGLE enables RCE via crafted HTML page visit, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of flaws such as the heap buffer overflow in Chrome's ANGLE component via vendor patches.
Implements memory protection safeguards like ASLR and DEP to block arbitrary code execution from heap buffer overflows during graphics rendering.
Ensures monitoring and dissemination of security advisories for Chrome updates that remediate this specific vulnerability.