This vulnerability (CVE-2026-5873) is an out-of-bounds read and write issue in the V8 engine component of Google Chrome before version 147.0.7727.55. It enables remote code execution inside the sandbox when a user visits a maliciously crafted HTML page. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with no privileges required and user interaction needed. The vulnerability is tracked under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The vendor advisory URL is provided but does not explicitly state patch availability or remediation details.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of the Chrome browser, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction (visiting a crafted HTML page) and no prior privileges. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply official Chrome updates promptly once available. Until a patch is confirmed, exercising caution with untrusted web content is advised.