Cyber Posture

CVE-2026-5874

Critical

Published: 08 April 2026

Published
08 April 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0013 31.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5874 is a critical-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 31.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and remediation of flaws like this use-after-free vulnerability through patching Chrome to version 147.0.7727.55 or later.

prevent

Implements memory protection safeguards such as ASLR and DEP to directly mitigate use-after-free exploits that could lead to sandbox escape.

prevent

Enforces process isolation via sandboxing to limit the scope and impact of vulnerabilities like this PrivateAI sandbox escape attempt.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Use-after-free vulnerability exploited via crafted HTML page with user UI interaction enables arbitrary code execution in client browser (T1203: Exploitation for Client Execution). Leads to sandbox escape, facilitating privilege escalation via exploitation (T1068: Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Deeper analysisAI

CVE-2026-5874 is a use-after-free vulnerability (CWE-416) in the PrivateAI component of Google Chrome prior to version 147.0.7727.55. Published on 2026-04-08, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is classified as Medium severity by Chromium security.

A remote attacker can exploit this vulnerability by convincing a user to engage in specific UI gestures while visiting a crafted HTML page, potentially achieving a sandbox escape with high confidentiality, integrity, and availability impacts due to the elevated scope.

Mitigation is available via the stable channel update to Google Chrome 147.0.7727.55 or later, as detailed in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/485397279. Security practitioners should prioritize updating affected browsers.

Details

CWE(s)

Affected Products

google
chrome
≤ 147.0.7727.55

CVEs Like This One

CVE-2026-6304Same product: Apple Macos
CVE-2026-7922Same product: Apple Macos
CVE-2026-7991Same product: Apple Macos
CVE-2026-6309Same product: Apple Macos
CVE-2026-4676Same product: Apple Macos
CVE-2026-5289Same product: Apple Macos
CVE-2026-7970Same product: Apple Macos
CVE-2026-7908Same product: Apple Macos
CVE-2026-3924Same product: Apple Macos
CVE-2026-6297Same product: Apple Macos

References