PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5865 Google CVE debrief

A type confusion vulnerability in Google Chrome's V8 JavaScript engine, rated High severity with a CVSS 3.1 score of 8.8, enables remote code execution within the browser sandbox when a user visits a malicious HTML page. The flaw was present in Chrome versions prior to 147.0.7727.55. Google addressed this vulnerability in the April 2026 stable channel update. The vendor attribution to Apple in source metadata appears to be a CPE association error; the affected product is Google Chrome.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Organizations with Chrome deployments, particularly those with users who browse untrusted web content; security teams monitoring browser-based attack vectors; incident responders tracking potential watering-hole or drive-by download campaigns.

Technical summary

CVE-2026-5865 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome. Type confusion occurs when code accesses an object using an incompatible type, potentially leading to out-of-bounds memory access, use-after-free conditions, or controlled memory corruption. In this case, exploitation through a crafted HTML page allows an attacker to achieve arbitrary code execution within Chrome's sandboxed renderer process. The vulnerability requires user interaction (visiting a malicious page) and has network attack vector with low complexity. While sandbox containment limits immediate system compromise, successful exploitation within the renderer process may enable further sandbox escape chains.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later. Chrome typically auto-updates; verify update completion via chrome://settings/help.
  • For managed enterprise environments, prioritize deployment of Chrome 147.0.7727.55+ through organizational update channels.
  • Consider enabling site isolation and enhanced safe browsing as defense-in-depth measures, though these do not eliminate the patching requirement.
  • Monitor for anomalous browser process behavior or unexpected sandbox escapes as potential exploitation indicators.

Evidence notes

The CVE description and NVD CPE data confirm Google Chrome as the affected product with vulnerable versions prior to 147.0.7727.55. The vendor field showing 'Apple' with medium confidence reflects a CPE record association (cpe:2.3:o:apple:macos) marked as not vulnerable, which appears to be platform context rather than product attribution. Chrome release notes and Chromium issue tracker provide authoritative vendor confirmation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5865 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5865

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5865 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5865

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.