PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5914 Google CVE debrief

CVE-2026-5914 is a HIGH severity vulnerability in Google Chrome prior to 147.0.7727.55. This Type Confusion in CSS vulnerability allows an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. The Chromium security severity is rated as Low, but the CVSS score is 8.8, indicating a HIGH severity vulnerability. The vulnerability affects Google Chrome users who have not updated to the latest version. Administrators of systems with Chrome installed should ensure that the browser is updated to prevent potential exploitation. The source details are limited, and defenders should verify the affected scope and severity.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should update to the latest version to mitigate this vulnerability. Additionally, administrators of systems with Chrome installed should ensure that the browser is updated to prevent potential exploitation. IT teams and security personnel responsible for managing Chrome deployments should prioritize updating Chrome to the latest version.

Technical summary

The vulnerability is caused by a Type Confusion in CSS in Google Chrome prior to version 147.0.7727.55. An attacker can exploit this vulnerability by convincing a user to install a malicious extension, which can then be used to potentially exploit heap corruption via a crafted Chrome Extension. The vulnerability has a CVSS score of 8.8 and a CVSS severity of HIGH. The Chromium security severity is rated as Low. The vulnerability affects Google Chrome users who have not updated to the latest version.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later
  • Ensure that all Chrome extensions are from trusted sources
  • Monitor Chrome for any suspicious activity
  • Implement a web application firewall to detect and prevent exploitation attempts
  • Conduct regular vulnerability scans and penetration testing to identify potential weaknesses
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:31.343Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Modified. This vulnerability affects Google Chrome prior to version 147.0.7727.55. The Chromium security severity is rated as Low, but the CVSS score is 8.8, indicating a HIGH severity vulnerability. The vulnerability is caused by a Type Confusion in CSS in Google Chrome. An attacker can exploit this vulnerability by convincing a user to install a malicious extension, which can then be used to potentially exploit heap corruption via a crafted Chrome Extension. The source details are limited, and defenders should verify the affected scope and severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5914 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5914

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5914 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5914

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.