CVE-2026-5879
Published: 08 April 2026
Summary
CVE-2026-5879 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-5879 is an insufficient validation of untrusted input vulnerability (CWE-20) in the ANGLE graphics component within Google Chrome on macOS versions prior to 147.0.7727.55. This flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox via a crafted HTML page. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated Medium severity by Chromium security.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page in an affected Chrome browser on Mac. No privileges are required (PR:N), but user interaction is needed (UI:R), such as clicking a link. Successful exploitation enables arbitrary code execution confined to the sandbox, potentially leading to high-impact confidentiality, integrity, and availability compromises within that isolated environment.
Google's stable channel update for desktop, announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, patches this issue in Chrome 147.0.7727.55 and later versions for Mac. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/40073848. Security practitioners should advise users to update Chrome immediately to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20685
Vulnerability details
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables drive-by compromise (T1189) via crafted HTML pages on malicious websites and exploitation for client execution (T1203) in the Chrome browser sandbox.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-5879 by requiring timely patching of vulnerable Google Chrome versions prior to 147.0.7727.55.
Identifies the presence of the unpatched Chrome vulnerability through regular vulnerability scanning of installed software.
Ensures monitoring of vendor security advisories like Chrome release notes to promptly learn of and address the ANGLE input validation flaw.