CVE-2026-5915
Published: 08 April 2026
Summary
CVE-2026-5915 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Chrome. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5915 involves insufficient validation of untrusted input in the WebML component of Google Chrome prior to version 147.0.7727.55. This vulnerability enables a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. It is classified under CWE-20: Improper Input Validation, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), though Chromium rates its security severity as Low.
A remote attacker can exploit this over the network with low attack complexity and no privileges, requiring user interaction such as visiting a malicious webpage. Exploitation results in high-impact integrity and availability violations through the out-of-bounds memory write, with no confidentiality impact.
Mitigation is available via the Google Chrome stable channel update to version 147.0.7727.55 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/494341335. Security practitioners should prioritize updating affected browsers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20750
Vulnerability details
Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of a client-side browser component (Google Chrome WebML) via a crafted HTML page, directly facilitating Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of untrusted inputs like crafted HTML pages in WebML to prevent out-of-bounds memory writes.
Implements memory safeguards such as bounds checking and isolation to protect against out-of-bounds memory write exploits.
Requires timely patching of flaws like CVE-2026-5915 by updating Google Chrome to version 147.0.7727.55 or later.