Description
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An insecure implementation in the V8 JavaScript engine of Google Chrome enables a remote attacker to run arbitrary code within the browser sandbox. By serving a specially crafted HTML page, the attacker can bypass sandbox restrictions and execute code with the privileges of the user. The vulnerability is marked high severity with a CVSS score of 8.8, indicating significant potential for damage.

Affected Systems

This flaw affects Google Chrome versions earlier than 147.0.7727.55 on all supported operating systems, including macOS, Linux, and Windows. The CPE data confirms that any Chrome installation running a vulnerable version is impacted, regardless of the underlying OS.

Risk and Exploitability

The low EPSS score of under 1% suggests that exploitation is not yet widespread, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high CVSS score and remote execution capability make it a serious threat. An attacker could gain full code execution inside the user's session by merely loading a malicious webpage, making patching the highest priority.

Generated by OpenCVE AI on April 13, 2026 at 18:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to Google Chrome version 147.0.7727.55 or later.

Generated by OpenCVE AI on April 13, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6205-1 chromium security update
History

Mon, 13 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Mon, 13 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Inappropriate implementation in V8
Weaknesses CWE-130
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 08 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-13T13:18:17.045Z

Reserved: 2026-04-08T19:34:32.627Z

Link: CVE-2026-5862

cve-icon Vulnrichment

Updated: 2026-04-13T13:17:59.598Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-08T22:16:25.720

Modified: 2026-04-13T17:23:10.410

Link: CVE-2026-5862

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-07T00:00:00Z

Links: CVE-2026-5862 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:38:07Z

Weaknesses