CVE-2026-5282
Published: 01 April 2026
Summary
CVE-2026-5282 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 20.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely remediation through patching Google Chrome to version 146.0.7680.178 or later, eliminating the out-of-bounds read vulnerability in WebCodecs.
Implements memory protection mechanisms such as bounds checking, ASLR, and DEP to directly prevent exploitation of the out-of-bounds memory read in the WebCodecs component.
Enforces process isolation in the browser's multi-process architecture to sandbox WebCodecs processing, limiting the impact of memory disclosure from crafted HTML pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in Chrome WebCodecs exploitable via crafted HTML on malicious site enables Drive-by Compromise (T1189) for initial access with memory disclosure.
NVD Description
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-5282 is an out-of-bounds read vulnerability in the WebCodecs component of Google Chrome versions prior to 146.0.7680.178. It enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. The issue, classified under CWE-125, carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, requiring no privileges or special access. Successful exploitation allows high-impact confidentiality loss through memory disclosure and high-impact availability disruption, such as application crashes, while integrity remains unaffected.
Google's stable channel update advisory at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html details the patch in Chrome version 146.0.7680.178. The Chromium issue tracker entry at https://issues.chromium.org/issues/491655161 provides further technical details on the fix. Security practitioners should prioritize updating affected Chrome installations to mitigate the risk.
Details
- CWE(s)