Cyber Resilience

CVE-2026-5868

High

Published: 08 April 2026

Published
08 April 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0034 25.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-5868 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-5868 is a heap buffer overflow vulnerability (CWE-122) in the ANGLE graphics component within Google Chrome on macOS, affecting versions prior to 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security.

A remote attacker can exploit this vulnerability by tricking a user into visiting a crafted HTML page, which triggers the heap buffer overflow during rendering. Successful exploitation allows arbitrary code execution confined to the browser's sandbox, potentially compromising the user's session within that isolated environment while requiring user interaction.

Mitigation is available via the Google Chrome stable channel update for desktop, as announced in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html). Security practitioners should advise users to update to Chrome 147.0.7727.55 or later on macOS. Additional technical details and the upstream fix are tracked in Chromium issue 493256564 (https://issues.chromium.org/issues/493256564).

EU & UK References

Vulnerability details

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-122

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Heap buffer overflow in browser graphics component enables arbitrary code execution via crafted HTML page visit, directly mapping to drive-by compromise and client-side exploitation for code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8525Same product: Apple Macos
CVE-2026-9999Same product: Apple Macos
CVE-2026-9930Same product: Apple Macos
CVE-2026-7901Same product: Apple Macos
CVE-2026-5879Same product: Apple Macos
CVE-2026-8522Same product: Apple Macos
CVE-2026-9884Same product: Apple Macos
CVE-2026-8517Same product: Apple Macos
CVE-2026-9964Same product: Apple Macos
CVE-2026-9990Same product: Apple Macos

Affected Assets

google
chrome
≤ 147.0.7727.55

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely patching of the heap buffer overflow vulnerability in Chrome's ANGLE component to version 147.0.7727.55 or later.

SI-16 Memory Protection good match
prevent

Implements memory protections like ASLR and DEP that specifically mitigate heap buffer overflow exploits allowing arbitrary code execution.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Requires receiving and acting on vendor security advisories such as the Chrome Releases blog announcement for this vulnerability.

References