Cyber Posture

CVE-2026-5290

Critical

Published: 01 April 2026

Published
01 April 2026
Modified
01 April 2026
KEV Added
Patch
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0003 7.4th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5290 is a critical-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation requires timely patching of the use-after-free vulnerability in Chrome's Compositing component to version 146.0.7680.178, directly preventing sandbox escape exploitation.

prevent

Memory protection techniques like ASLR and DEP directly mitigate use-after-free vulnerabilities by preventing unauthorized code execution in the compromised renderer process.

prevent

Process isolation enforces renderer sandbox boundaries, limiting the impact of use-after-free exploitation attempting to escape to other system processes.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
Why these techniques?

Use-after-free in Chrome renderer enables sandbox escape after initial renderer compromise, directly mapping to privilege escalation (T1068); delivered via crafted HTML on malicious site with user interaction, enabling drive-by compromise (T1189).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-5290 is a use-after-free vulnerability (CWE-416) in the Compositing component of Google Chrome prior to version 146.0.7680.178. Published on 2026-04-01, it has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is classified as High severity by Chromium security.

The vulnerability allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious site, but no privileges or special access beyond the initial renderer compromise.

Google addressed the issue in the stable channel update for desktop Chrome 146.0.7680.178, as announced at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/496205576.

Details

CWE(s)

Affected Products

google
chrome
≤ 146.0.7680.177

CVEs Like This One

CVE-2026-5288Same product: Apple Macos
CVE-2026-6297Same product: Apple Macos
CVE-2026-3924Same product: Apple Macos
CVE-2026-4456Same product: Apple Macos
CVE-2026-7343Same product: Apple Macos
CVE-2026-5278Same product: Apple Macos
CVE-2026-6310Same product: Apple Macos
CVE-2026-5285Same product: Apple Macos
CVE-2026-5883Same product: Apple Macos
CVE-2026-4678Same product: Apple Macos

References