PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5867 Google CVE debrief

A heap buffer overflow vulnerability in WebML (Web Machine Learning) within Google Chrome versions prior to 147.0.7727.55 could allow a remote attacker to extract potentially sensitive information from process memory by enticing a user to visit a crafted HTML page. The vulnerability was assigned a High severity rating by the Chromium security team and received a CVSS 3.1 score of 4.3 (Medium). The issue was publicly disclosed on April 8, 2026, with the NVD record subsequently modified on May 26, 2026. Google addressed this vulnerability in the Chrome 147.0.7727.55 stable channel update. The underlying weakness is categorized as CWE-122 (Heap-based Buffer Overflow). No known exploitation in the wild or ransomware campaign use has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-05-26
Advisory published
2026-04-08
Advisory updated
2026-05-26

Who should care

Organizations with Chrome deployments, particularly those with users who may visit untrusted web content; security teams monitoring browser-based attack vectors; developers building web applications that utilize WebML APIs

Technical summary

The vulnerability exists in Chrome's WebML implementation, where improper bounds checking on heap-allocated buffers could allow out-of-bounds memory reads. A remote attacker could craft a malicious HTML page that, when loaded by a victim, triggers the overflow and leaks sensitive data from the browser process memory. The attack requires user interaction (visiting the malicious page) but no authentication or elevated privileges. The fix was released in Chrome 147.0.7727.55.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later to remediate this vulnerability
  • Verify Chrome auto-update is enabled and functioning in enterprise environments
  • Consider implementing site isolation policies to limit impact of renderer exploits
  • Monitor for unusual memory access patterns or crashes in Chrome processes as potential indicators of exploitation attempts
  • Review and restrict access to untrusted or suspicious websites, as user interaction is required for exploitation

Evidence notes

The CVE description and NVD metadata confirm this is a Chrome WebML heap buffer overflow patched in version 147.0.7727.55. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, but user interaction required, with low confidentiality impact. The vendor field shows 'Apple' with medium confidence from NVD CPE data, though this appears to be a data quality artifact—the CPE criteria clearly identify Google Chrome as the vulnerable product. The vulnerability is not marked as KEV and has no known ransomware use.

Official resources

2026-04-08