PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5865 Google CVE debrief

A type confusion vulnerability in Google Chrome's V8 JavaScript engine, rated High severity with a CVSS 3.1 score of 8.8, enables remote code execution within the browser sandbox when a user visits a malicious HTML page. The flaw was present in Chrome versions prior to 147.0.7727.55. Google addressed this vulnerability in the April 2026 stable channel update. The vendor attribution to Apple in source metadata appears to be a CPE association error; the affected product is Google Chrome.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-05-26
Advisory published
2026-04-08
Advisory updated
2026-05-26

Who should care

Organizations with Chrome deployments, particularly those with users who browse untrusted web content; security teams monitoring browser-based attack vectors; incident responders tracking potential watering-hole or drive-by download campaigns.

Technical summary

CVE-2026-5865 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome. Type confusion occurs when code accesses an object using an incompatible type, potentially leading to out-of-bounds memory access, use-after-free conditions, or controlled memory corruption. In this case, exploitation through a crafted HTML page allows an attacker to achieve arbitrary code execution within Chrome's sandboxed renderer process. The vulnerability requires user interaction (visiting a malicious page) and has network attack vector with low complexity. While sandbox containment limits immediate system compromise, successful exploitation within the renderer process may enable further sandbox escape chains.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later. Chrome typically auto-updates; verify update completion via chrome://settings/help.
  • For managed enterprise environments, prioritize deployment of Chrome 147.0.7727.55+ through organizational update channels.
  • Consider enabling site isolation and enhanced safe browsing as defense-in-depth measures, though these do not eliminate the patching requirement.
  • Monitor for anomalous browser process behavior or unexpected sandbox escapes as potential exploitation indicators.

Evidence notes

The CVE description and NVD CPE data confirm Google Chrome as the affected product with vulnerable versions prior to 147.0.7727.55. The vendor field showing 'Apple' with medium confidence reflects a CPE record association (cpe:2.3:o:apple:macos) marked as not vulnerable, which appears to be platform context rather than product attribution. Chrome release notes and Chromium issue tracker provide authoritative vendor confirmation.

Official resources

2026-04-08