Description
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-08
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Type confusion in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser's sandbox by opening a crafted HTML page. The vulnerability was reported as high severity by Chromium.

Affected Systems

All installations of Google Chrome on the stable channel older than version 147.0.7727.55 across Windows, macOS, Linux, and other supported platforms are impacted.

Risk and Exploitability

No CVSS or EPSS metrics are provided. Chromium rated the issue as high severity. The attack vector is remote, requiring the user to visit a malicious web page. Successful exploitation would enable execution of code within the browser's sandbox. There is currently no public exploitation evidence, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on April 8, 2026 at 23:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 147.0.7727.55 or newer
  • Ensure automatic updates are enabled so future patches are applied promptly.

Generated by OpenCVE AI on April 8, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6205-1 chromium security update
History

Fri, 10 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enables Remote Code Execution in Chrome Sandbox chromium-browser: Type Confusion in V8
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enables Remote Code Execution in Chrome Sandbox
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 08 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
Description Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-10T03:55:44.173Z

Reserved: 2026-04-08T19:34:33.369Z

Link: CVE-2026-5865

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-08T22:16:26.017

Modified: 2026-04-08T22:16:26.017

Link: CVE-2026-5865

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-07T00:00:00Z

Links: CVE-2026-5865 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:27:01Z

Weaknesses