CVE-2026-5871: Google Chrome V8 RCE Vulnerability

CVE-2026-5871 Overview

CVE-2026-5871 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 147.0.7727.55. The flaw allows a remote attacker to execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. Google's Chromium security team rated the issue High severity. The vulnerability falls under CWE-843, which covers access of resources using an incompatible type.

Affected browsers run on Windows, macOS, and Linux. User interaction is required because exploitation depends on the victim loading attacker-controlled web content.

Critical Impact

Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox by luring a user to a malicious web page.

Affected Products

• Google Chrome prior to 147.0.7727.55
• Chrome on Apple macOS, Microsoft Windows, and Linux
• Chromium-based browsers that embed vulnerable V8 builds

Discovery Timeline

• 2026-04-08 - CVE-2026-5871 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-5871

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code allocates or accesses a resource as one type while another part of the engine treats the same memory region as a different, incompatible type. In V8, this typically arises in the optimizing compiler (TurboFan or Maglev) when speculative assumptions about object shapes or element kinds are not correctly invalidated.

When the engine reads a field using the wrong type descriptor, attacker-controlled data is interpreted as a pointer, length, or function reference. Exploitation generally chains the primitive into an arbitrary read/write inside the renderer process, leading to code execution within the Chrome sandbox.

Because the attack vector is network-based and requires only that a user open a crafted page, exploitation is feasible through drive-by downloads, malvertising, or targeted phishing links.

Root Cause

The root cause is incorrect type handling in V8 ([CWE-843]). The engine performs operations on an object assuming a type that does not match the object's actual representation, breaking memory safety invariants enforced by the JIT compiler and garbage collector.

Attack Vector

An attacker hosts a malicious HTML page containing JavaScript designed to trigger the type confusion in V8. When the victim visits the page, the engine mis-types an object, granting the attacker memory corruption primitives that allow arbitrary code execution within the renderer sandbox. Sandbox escape would require chaining a separate vulnerability. Technical specifics are tracked in the Chromium Issue Tracker Entry, which remains restricted at the time of publication.

Detection Methods for CVE-2026-5871

Indicators of Compromise

• Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or /bin/sh.
• Outbound network connections from the Chrome process to unfamiliar domains immediately after page loads.
• Crash reports in Chrome referencing V8 with access violation signatures on recently visited URLs.

Detection Strategies

• Inventory Chrome versions across endpoints and flag any build below 147.0.7727.55.
• Inspect web proxy and DNS logs for users visiting newly registered or low-reputation domains that serve heavy JavaScript payloads.
• Hunt for renderer-to-shell process lineage, which is anomalous for a sandboxed browser tab.

Monitoring Recommendations

• Forward browser process telemetry and EDR events to a central analytics platform for correlation.
• Alert on Chrome processes writing executables to user-writable paths such as %TEMP% or ~/Library/Caches.
• Track Chromium crash dumps tagged with V8 type confusion signatures and correlate with URL history.

How to Mitigate CVE-2026-5871

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later on all Windows, macOS, and Linux endpoints.
• Restart browsers after deployment to ensure the patched V8 binary is loaded.
• Validate that managed Chromium-based browsers (Edge, Brave, Opera) have absorbed the upstream V8 fix.

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Update Announcement. Administrators should deploy 147.0.7727.55 or newer through their managed update channel and confirm the version via chrome://settings/help.

Workarounds

• Enforce automatic Chrome updates through enterprise policy until patching is verified.
• Restrict JavaScript execution on untrusted sites using group policy or browser extensions where feasible.
• Apply web filtering to block access to known malicious or low-reputation domains hosting exploit content.

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: enforce minimum version via registry (Chrome Enterprise)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "147.0.7727.55" /f