CVE-2026-5873
published 2026-04-08CVE-2026-5873: Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | chromium | < chromium 147.0.7727.55-1 (sid) | chromium 147.0.7727.55-1 (sid) |
| chrome | < 147.0.7727.55 | 147.0.7727.55 | |
| chrome | >= 147.0.7727.55 < 147.0.7727.55 | 147.0.7727.55 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
VulDB
Google Chrome up to 146.0.7680.178 V8 out-of-bounds write (ID 496301 / WID-SEC-2026-1030)
vuldb·2026-04-10·CVSS 8.8
CVE-2026-5873 [HIGH] Google Chrome up to 146.0.7680.178 V8 out-of-bounds write (ID 496301 / WID-SEC-2026-1030)
A vulnerability was found in Google Chrome. It has been classified as critical. The affected element is an unknown function of the component V8. The manipulation leads to out-of-bounds write.
This vulnerability is uniquely identified as CVE-2026-5873. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
GHSA-5grw-5p3c-hg2g: Out of bounds read and write in V8 in Google Chrome prior to 147
ghsa_unreviewed·2026-04-09
CVE-2026-5873 GHSA-5grw-5p3c-hg2g: Out of bounds read and write in V8 in Google Chrome prior to 147
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
OSV
CVE-2026-5873: Out of bounds read and write in V8 in Google Chrome prior to 147
osv·2026-04-08·CVSS 8.8
CVE-2026-5873 [HIGH] CVE-2026-5873: Out of bounds read and write in V8 in Google Chrome prior to 147
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Red Hat
chromium-browser: Out of bounds read and write in V8
vendor_redhat·2026-04-07·CVSS 8.8
CVE-2026-5873 [HIGH] CWE-125 chromium-browser: Out of bounds read and write in V8
chromium-browser: Out of bounds read and write in V8
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
An out of bounds read and write flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=496301615
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-5873
vendor_chrome·2026-04-07·CVSS 8.8
CVE-2026-5873 [HIGH] Stable Channel Update for Desktop: CVE-2026-5873
Stable Channel Update for Desktop
CVE-2026-5873: Out of bounds read and write in V8. Reported by Google on 2026-03-25 [$11000][ 485397279 ] Medium CVE-2026-5874: Use after free in PrivateAI
Reported by Krace on 2026-02-18 [$4000][ 430198264 ] Medium CVE-2026-5875: Policy bypass in Blink
Severity: high
Debian
CVE-2026-5873: chromium - Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allow...
vendor_debian·2026·CVSS 8.8
CVE-2026-5873 [HIGH] CVE-2026-5873: chromium - Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allow...
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Scope: local
bookworm: open
bullseye: open
forky: open
sid: resolved (fixed in 147.0.7727.55-1)
trixie: open
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
blogs_hackernews·2026-04-20
CVE-2026-20184 ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More
Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.
There’s also a shift in how attacks run. Slower check-ins, multi-stage payloads, andmore code kept in memory. Attackers lean on real tools and normal workflows instead of custom builds. Some cas
Sans Isc
Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
blogs_sans_isc·2026-04-14·CVSS 8.8
[HIGH] Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
Microsoft Patch Tuesday April 2026.
Published: 2026-04-14. Last Updated: 2026-04-14 17:46:09 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
This month's Microsoft Patch Tuesday looks like a record one, but let's look at it a bit closer to understand what is happening
The update patches a total of 243 vulnerabilities. However, 78 of them are Chromium issues affecting Microsoft Edge. Patches for Edge were released earlier. This leaves 165 vulnerabilities that are not Edge-related. Of these, 8 are rated critical, and 154 are important. One vulnerability has already been exploited, and another was made public before today but has not yet been seen in the wild.
Noteworthy Vulnerabilities:
CVE-2026-33827 (Windows TCP/IP Remote Code Execution Vulnerability): As a packet nerd, I love thes
Hackernews
⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
blogs_hackernews·2026-04-13·CVSS 8.6
[HIGH] ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basically non-existent.
The variety this week is particularly nasty. We have AI models being turned into autonomous exploit engines, North Korean groups playing the long game
Wiz
CVE-2026-5873 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-5873 [HIGH] CVE-2026-5873 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5873 :
Google Chrome vulnerability analysis and mitigation
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Source : NVD
Published April 8, 2026
CNA Score N/A
Affected Technologies
Google Chrome
Chromium
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 11.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
chromium
cpe:2.3:a:google:chrome
Sources
NVD
Debian 11, 12, 13, 14 No Fix Added at: Apr 09, 2026
Echo No Fix Added at: Apr 09, 2026
Linux Has Fix Added at: Apr 09, 2026
Windows Has Fix Added at: A
Bugzilla
CVE-2026-5873 chromium-browser: Out of bounds read and write in V8
bugzilla·2026-04-08·CVSS 8.8
CVE-2026-5873 [HIGH] CVE-2026-5873 chromium-browser: Out of bounds read and write in V8
CVE-2026-5873 chromium-browser: Out of bounds read and write in V8
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
2026-04-08
Published