CVE-2026-5858
Published: 08 April 2026
Summary
CVE-2026-5858 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 44.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5858 is a heap buffer overflow vulnerability (CWE-122) in the WebML component of Google Chrome versions prior to 147.0.7727.55. Published on 2026-04-08, this critical issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), enabling potential arbitrary code execution.
A remote attacker can exploit the vulnerability by crafting an HTML page that triggers the heap buffer overflow in WebML when rendered in an affected Chrome browser. Exploitation requires user interaction, such as visiting the malicious page, but no privileges or special access, allowing the attacker to execute arbitrary code with high-impact consequences on confidentiality, integrity, and availability within the browser's context.
The Chrome Releases stable channel update for desktop and Chromium issue 493319454 detail the patch, with mitigation achieved by upgrading to Google Chrome 147.0.7727.55 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20651
Vulnerability details
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome WebML enables arbitrary code execution via malicious HTML page visited by user, directly mapping to Drive-by Compromise (T1189) for initial access and Exploitation for Client Execution (T1203) for browser RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of the heap buffer overflow vulnerability through patching Google Chrome to version 147.0.7727.55 or later.
Provides memory safeguards like ASLR and DEP that directly mitigate heap buffer overflow exploits enabling arbitrary code execution in WebML.
Enforces browser process isolation and sandboxing to contain arbitrary code execution within the renderer process triggered by the crafted HTML page.