{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5870", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-04-08T19:34:34.701Z", "datePublished": "2026-04-08T21:20:44.311Z", "dateUpdated": "2026-04-08T21:20:44.311Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "147.0.7727.55", "status": "affected", "lessThan": "147.0.7727.55", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer overflow", "cweId": "CWE-472"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-04-08T21:20:44.311Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"url": "https://issues.chromium.org/issues/495534710"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)"}], "id": "CVE-2026-5870", "lastModified": "2026-04-08T22:16:26.580", "metrics": {}, "published": "2026-04-08T22:16:26.580", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/495534710"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-472"}], "source": "chrome-cve-admin@google.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[147.0.7727.55,147.0.7727.55)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-09T00:05:49.607668+00:00", "value": {"mitigation_remediation": ["Upgrade Google Chrome to version 147.0.7727.55 or newer, which contains a patch for the Skia overflow.", "Verify that automatic updates are enabled so that future security patches are applied automatically."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All users running a Chrome stable channel version earlier than 147.0.7727.55 are affected. The vulnerability is present in every build before that revision, regardless of operating system. Updating to any Chrome release equal to or newer than 147.0.7727.55 removes the flaw.", "description_and_impact": "An integer overflow in the Skia graphics engine of Google Chrome allows a remote attacker to execute arbitrary code while the browser process remains sandboxed. The flaw, classified as CWE\u2011472, is triggered by a specially crafted HTML page served to a user\u2019s browser. Because the malicious payload runs inside the sandbox, an attacker could gain control of the browser process, potentially allowing data exfiltration or manipulation of the user session.", "risk_and_exploitability": "Chromium has labeled the issue as high severity. A remote attacker can trigger the overflow by loading a malicious web page, and the vulnerability has not been listed in CISA\u2019s Known Exploited Vulnerabilities catalog. EPSS information is not available, but the combination of a high severity rating and the ability to launch the attack over the Internet indicates a significant risk for unpatched users."}}}}, "created": "2026-04-09T08:17:32.562979+00:00", "title": "Integer Overflow in Skia Enables Remote Code Execution in Chrome", "updated": "2026-04-09T08:26:56.038311+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}