CVE-2026-5873

CVE-2026-5873 is an out-of-bounds memory vulnerability affecting Google Chrome versions prior to 147.0.7727.55, residing in the V8 JavaScript engine. A remote attacker can exploit this flaw by crafting a malicious HTML page to trigger arbitrary code execution within Chrome's sandbox environment. The vulnerability carries a HIGH severity rating from Chromium security analysts. The vulnerability presents a network-based attack vector with low complexity and no privilege requirements, requiring only user interaction to trigger exploitation. With a CVSS v3.1 score of 8.8, it poses significant risk across confidentiality, integrity, and availability, allowing attackers to potentially escape sandbox protections and compromise system security. Exploitation status indicates minimal active threat currently. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and it does not appear on active exploitation lists. The extremely low EPSS score of 0.001020000 suggests that real-world exploitation likelihood remains low at this time, though organizations should prioritize patching to Chrome 147.0.7727.55 or later as a preventive measure.