CVE-2026-5874
A memory‑management bug in Google Chrome’s PrivateAI component lets a malicious web page cause a use‑after‑free that can break out of the browser sandbox. If a user follows a trick on the page, the attacker could run code with the same privileges as the browser. The flaw is only exploitable on Chrome versions before 147.0.7727.55.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome users on any operating system using a version older than 147.0.7727.55. The vulnerability is tied to the PrivateAI component and affects Windows, macOS, and Linux.
Real-world impact
An attacker could escape the browser sandbox and execute code on the user’s computer, potentially taking full control of the system.
Why this severity
The CVSS score of 9.6 reflects that the flaw is remote, requires no special privileges, needs only user interaction, and gives an attacker full confidentiality, integrity, and availability compromise.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/04/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/485397279permissions required