CVE-2026-5883
Published: 08 April 2026
Summary
CVE-2026-5883 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5883 is a use-after-free vulnerability (CWE-416) in the Media component of Google Chrome versions prior to 147.0.7727.55. The flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox via a crafted HTML page. Chromium rates the issue as Medium severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), highlighting its potential for high-impact exploitation despite requiring user interaction.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website containing the crafted HTML page. No special privileges are needed, and the attack requires only network access and user interaction, such as loading the page. Successful exploitation enables arbitrary code execution within the sandboxed environment, potentially leading to high confidentiality, integrity, and availability impacts.
Mitigation is addressed in the Google Chrome stable channel update for desktop, detailed at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/482958590. Users should update to Chrome 147.0.7727.55 or later to patch the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20693
Vulnerability details
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a use-after-free in Chrome's Media component exploited via a crafted HTML page on a malicious website, enabling drive-by compromise (T1189) and exploitation for client execution (T1203) with user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the use-after-free vulnerability in Chrome's Media component through patching to version 147.0.7727.55 or later.
Implements memory protection mechanisms such as ASLR and DEP that mitigate exploitation of use-after-free errors by preventing arbitrary code execution from corrupted memory.
Deploys malicious code protection at system entry points to block or detect code execution attempts from crafted HTML pages exploiting the vulnerability.