CVE-2026-5904

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5904", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "REJECTED", "assignerShortName": "Chrome", "dateReserved": "2026-04-08T19:34:43.875Z", "datePublished": "2026-04-08T21:21:00.932Z", "dateUpdated": "2026-06-16T21:49:29.952Z", "dateRejected": "2026-06-16T21:49:29.952Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-06-16T21:49:29.952Z"}, "rejectedReasons": [{"lang": "en", "value": "Determined a bug and not a vulnerability"}]}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5904", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "REJECTED", "assignerShortName": "Chrome", "dateReserved": "2026-04-08T19:34:43.875Z", "datePublished": "2026-04-08T21:21:00.932Z", "dateUpdated": "2026-06-16T21:49:29.952Z", "dateRejected": "2026-06-16T21:49:29.952Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-06-16T21:49:29.952Z"}, "rejectedReasons": [{"lang": "en", "value": "Determined a bug and not a vulnerability"}]}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: Determined a bug and not a vulnerability"}], "id": "CVE-2026-5904", "lastModified": "2026-06-17T13:20:53.360", "metrics": {}, "published": "2026-04-08T22:16:30.287", "references": [], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "chromium-browser: Use after free in V8", "id": "2456796", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456796"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["An use after free flaw was found in the V8 component of the Chromium browser.\nUpstream bug(s):\nhttps://code.google.com/p/chromium/issues/detail?id=483851888"], "name": "CVE-2026-5904", "public_date": "2026-04-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-5904\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5904\nhttps://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html\nhttps://issues.chromium.org/issues/483851888"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[147.0.7727.55,147.0.7727.55)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-13T23:06:59.498797+00:00", "value": {"mitigation_remediation": ["Update Google Chrome to version 147.0.7727.55 or later", "Confirm that all affected machines have installed the update", "Remove any untrusted or suspicious Chrome extensions", "Enforce automatic updates or apply enterprise update policies"], "summary": {"action": "Patch Now", "impact": "Potential remote code execution via malicious extension"}, "threat_synthesis": {"affected_systems": "Google Chrome users running any desktop version prior to 147.0.7727.55 on Windows, macOS or Linux are affected, because the V8 JavaScript engine is included with the browser on all those platforms.", "description_and_impact": "A use\u2011after\u2011free flaw in the V8 engine of Google Chrome can corrupt heap memory when a malicious Chrome extension is installed, potentially allowing an attacker to execute arbitrary code. The vulnerability arises after an object is freed while references still exist, violating memory safety. Based on the description, it is inferred that the resulting heap corruption could be leveraged to run attacker\u2011supplied code.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity risk, yet the EPSS score below 1% reflects a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to first install a malicious extension, so the likely attack vector is social engineering rather than an automated network attack."}}}}, "created": "2026-04-09T08:16:48.617406+00:00", "updated": "2026-04-14T16:37:25.028630+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}