Executive brief
A vulnerability in Google Chrome's V8 engine could allow a remote attacker to execute unauthorized code on a user's computer. This occurs when a user visits a specially crafted, malicious website. While the attack is limited to the browser's security sandbox, it represents a significant risk to data integrity and system security if combined with other flaws.
Technical details
This vulnerability (CVE-2026-5873) is classified as both an out-of-bounds read (CWE-125) and an out-of-bounds write (CWE-787) within the V8 JavaScript engine. The flaw is triggered when the engine processes a specifically crafted HTML page, allowing a remote, unauthenticated attacker to access or modify memory outside of the intended buffer. Successful exploitation enables arbitrary code execution within the confines of the Chromium renderer sandbox. The issue was addressed in Google Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-03-25: disclosed: Reported to Chrome by Google internal researchers
- 2026-04-07: patched: Fixed in Chrome 147 stable channel update
- 2026-04-08: advisory: NVD publication date