CVE-2026-5909
Published: 08 April 2026
Summary
CVE-2026-5909 is a high-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5909 is an integer overflow vulnerability (CWE-472) in the Media component of Google Chrome prior to version 147.0.7727.55. The flaw enables a remote attacker to potentially trigger heap corruption by processing a crafted video file. Although the Chromium security severity is rated as Low, the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability over the network with low complexity and no required privileges by convincing a user to open a malicious video file within an affected Chrome browser instance, as user interaction is necessary. Successful exploitation could lead to high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service through heap corruption.
Mitigation is available via the Google Chrome stable channel update for desktop, which patches the vulnerability in version 147.0.7727.55 and later, as announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/485203821. Security practitioners should prioritize updating affected Chrome installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20738
Vulnerability details
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The integer overflow in Chrome's media component enables client-side RCE via heap corruption when processing a crafted video file (T1203: Exploitation for Client Execution). Exploitation requires the victim to open the malicious file (T1204.002: Malicious File under User Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-5909 by requiring timely installation of the Chrome patch (147.0.7727.55) to remediate the integer overflow in the Media component.
Implements memory protections such as ASLR and DEP to prevent successful heap corruption exploitation from the crafted video file.
Requires validation of media file inputs to detect and block malformed video data that could trigger the integer overflow leading to heap corruption.