CVE-2026-5912
Published: 08 April 2026
Summary
CVE-2026-5912 is a high-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5912 is an integer overflow vulnerability (CWE-472) in the WebRTC component of Google Chrome prior to version 147.0.7727.55. The flaw enables a remote attacker to perform an out-of-bounds memory write by processing a crafted HTML page. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-04-08.
A remote attacker can exploit this vulnerability without authentication by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Successful exploitation allows arbitrary out-of-bounds memory writes, potentially resulting in high confidentiality, integrity, and availability impacts, including code execution or system compromise within the browser's sandbox.
Mitigation involves updating Google Chrome to version 147.0.7727.55 or later, as announced in the stable channel update for desktop at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Additional technical details are documented in the Chromium issue tracker at https://issues.chromium.org/issues/486498791, where it is rated as Low severity by Chromium security standards.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20744
Vulnerability details
Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in Chrome WebRTC enables out-of-bounds write via crafted HTML page, directly facilitating drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the integer overflow vulnerability by requiring timely remediation through patching Google Chrome to version 147.0.7727.55 or later.
Implements memory protection safeguards like ASLR and DEP that prevent exploitation of the out-of-bounds memory write for arbitrary code execution.
Enforces process isolation via browser sandboxing to confine any successful exploitation within WebRTC to a restricted process environment.