CVE-2026-5861
Published: 08 April 2026
Summary
CVE-2026-5861 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5861 is a use-after-free vulnerability (CWE-416) in the V8 JavaScript engine within Google Chrome versions prior to 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
A remote attacker can exploit this flaw by crafting an HTML page that, when loaded by a user in an affected Chrome browser, triggers the use-after-free condition in V8. This enables arbitrary code execution confined within the browser's sandbox, potentially compromising the user's system depending on further exploitation chains.
Mitigation is available via the Google Chrome stable channel update for desktop, which patches the issue in version 147.0.7727.55 and later, as announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/486927780. Security practitioners should prioritize updating affected browsers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20657
Vulnerability details
Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a use-after-free in Chrome's V8 engine exploitable via a crafted HTML page, enabling drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, prioritization, and remediation of flaws like the use-after-free vulnerability in Chrome's V8 engine via patching to version 147.0.7727.55 or later.
Mandates vulnerability scanning to identify systems running vulnerable Chrome versions affected by CVE-2026-5861 prior to exploitation.
Implements memory protection mechanisms that mitigate use-after-free exploits by restricting unauthorized code execution within the browser sandbox.