CVE-2026-5873
Published: 08 April 2026
Summary
CVE-2026-5873 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 29.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and patching of software flaws like the out-of-bounds read/write vulnerability in Chrome's V8 engine.
Implements controls to protect against memory exploits such as out-of-bounds reads and writes exploited by crafted HTML pages in this CVE.
Requires scanning for vulnerabilities like CVE-2026-5873 in browsers to identify outdated Chrome versions prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read/write in V8 JavaScript engine exploited via malicious HTML page for sandboxed code execution upon visiting website, directly enabling drive-by compromise (T1189) and exploitation for client execution (T1203).
NVD Description
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-5873 is an out-of-bounds read and write vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Chromium rated its security severity as High.
A remote attacker can exploit this vulnerability by crafting an HTML page that triggers the memory corruption when rendered in Chrome, enabling arbitrary code execution confined to the browser's sandbox. The attack requires user interaction, such as visiting a malicious website, but needs no privileges or authentication.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.55 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the associated Chromium issue tracker entry at https://issues.chromium.org/issues/496301615. Security practitioners should prioritize updating affected browsers.
Details
- CWE(s)