CVE-2026-5288
Published: 01 April 2026
Summary
CVE-2026-5288 is a critical-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5288 is a use-after-free vulnerability (CWE-416) in the WebView component of Google Chrome on Android prior to version 146.0.7680.178. Published on 2026-04-01, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and a Chromium security severity rating of High. The flaw allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
A remote attacker can exploit this vulnerability over the network with low complexity, requiring no privileges but user interaction, such as visiting a malicious site. Exploitation assumes prior compromise of the renderer process, enabling the attacker to escape the sandbox and gain elevated privileges, resulting in high confidentiality, integrity, and availability impacts.
Advisories reference a Chrome stable channel update at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html and the Chromium issue tracker at https://issues.chromium.org/issues/495507390, which detail the patch incorporating the fix in version 146.0.7680.178 and later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17806
Vulnerability details
Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in WebView enables sandbox escape (T1068 Exploitation for Privilege Escalation) after renderer compromise; attack vector via crafted HTML page on visited malicious site directly facilitates T1189 Drive-by Compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-5288 by requiring timely remediation through application of the Chrome patch to version 146.0.7680.178 or later.
Implements memory safeguards such as address space randomization and execution prevention to counter use-after-free exploitation in the renderer process.
Enforces process isolation for the renderer sandbox, limiting the scope and impact of sandbox escape attempts following renderer compromise.