CVE-2026-5863
Published: 08 April 2026
Summary
CVE-2026-5863 is a high-severity Improper Access Control (CWE-284) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and remediation of flaws like the V8 implementation vulnerability in CVE-2026-5863 via Chrome patching to version 147.0.7727.55 or later.
Vulnerability scanning and monitoring identifies systems with vulnerable Chrome versions affected by CVE-2026-5863, enabling targeted remediation.
Ensures organizations receive, disseminate, and implement security advisories such as the Chrome stable channel update addressing CVE-2026-5863.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a V8 JavaScript engine flaw in Chrome exploited via crafted HTML pages, enabling remote arbitrary code execution in the browser sandbox, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).
NVD Description
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-5863 is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 147.0.7727.55. It enables a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The issue carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with CWE details unavailable from NVD.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page, requiring user interaction but no special privileges. Successful exploitation allows arbitrary code execution confined to the sandboxed environment, potentially leading to high-impact confidentiality, integrity, and availability compromises within the browser context.
Mitigation is addressed in the Google Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, which covers versions 147.0.7727.55 and later. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/484527367. Security practitioners should ensure Chrome is updated to at least version 147.0.7727.55 to remediate the vulnerability.
Details
- CWE(s)