CVE-2026-5904: Google Chrome V8 Use-After-Free Flaw

CVE-2026-5904 Overview

CVE-2026-5904 is a Use After Free vulnerability in the V8 JavaScript engine in Google Chrome prior to version 147.0.7727.55. This memory corruption flaw could allow an attacker who convinces a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.

Critical Impact

Attackers who successfully convince users to install malicious Chrome extensions could exploit heap corruption in the V8 JavaScript engine, potentially leading to code execution or browser compromise.

Affected Products

• Google Chrome versions prior to 147.0.7727.55
• Chromium-based browsers using affected V8 engine versions

Discovery Timeline

• 2026-04-08 - CVE-2026-5904 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-5904

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption vulnerability that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of V8, Google Chrome's JavaScript engine, this can lead to heap corruption when processing JavaScript code from a malicious extension.

The V8 engine is responsible for compiling and executing JavaScript code within Chrome. Use After Free vulnerabilities in V8 are particularly dangerous because they can potentially be exploited to achieve arbitrary code execution within the browser's sandbox. However, Google's Chromium security team has rated this vulnerability as Low severity, likely due to the specific attack requirements—the attacker must first convince the user to install a malicious Chrome extension.

The attack vector requires social engineering to convince a victim to install a crafted Chrome Extension, which then triggers the memory corruption condition in V8 during JavaScript execution. This social engineering requirement significantly limits the scope of potential exploitation.

Root Cause

The vulnerability stems from improper memory management in the V8 JavaScript engine. Specifically, memory that has been deallocated is subsequently accessed, leading to a Use After Free condition. When V8 processes certain JavaScript code patterns from a malicious extension, the engine may reference memory locations that have already been freed, resulting in heap corruption.

Attack Vector

Exploitation of CVE-2026-5904 requires the following conditions:

1. The attacker must craft a malicious Chrome Extension that contains JavaScript code designed to trigger the Use After Free condition
2. The victim must be convinced to install this malicious extension, typically through social engineering
3. Once installed, the extension's code executes within the V8 engine, triggering the vulnerability
4. Successful exploitation could lead to heap corruption, potentially allowing further code execution or browser compromise

The requirement for user interaction (installing a malicious extension) significantly reduces the likelihood of widespread exploitation. See the Chromium Issue Tracker Entry for additional technical details.

Detection Methods for CVE-2026-5904

Indicators of Compromise

• Presence of unknown or suspicious Chrome extensions that were not intentionally installed by the user
• Unexpected Chrome crashes or instability, particularly when executing JavaScript-heavy operations
• Unusual memory consumption patterns in Chrome processes related to V8 execution

Detection Strategies

• Monitor for installation of Chrome extensions from untrusted sources or those with suspicious permissions
• Implement browser extension whitelisting policies to prevent installation of unauthorized extensions
• Deploy endpoint detection solutions that can identify anomalous browser behavior indicative of exploitation attempts
• Review Chrome extension audit logs for unexpected installations or permission changes

Monitoring Recommendations

• Enable Chrome Enterprise reporting to track extension installations across managed endpoints
• Configure SentinelOne to monitor for suspicious Chrome process behavior, including unusual memory access patterns
• Implement alerts for installation of extensions from outside the Chrome Web Store
• Monitor network traffic for communication patterns associated with malicious extensions

How to Mitigate CVE-2026-5904

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later immediately
• Audit currently installed Chrome extensions and remove any that are unknown, suspicious, or unnecessary
• Implement browser policies that restrict extension installation to approved sources only
• Educate users about the risks of installing browser extensions from untrusted sources

Patch Information

Google has released Chrome version 147.0.7727.55 which addresses this vulnerability. Organizations should prioritize updating Chrome installations across all managed endpoints. For detailed patch information, refer to the Google Chrome Stable Update announcement.

The patch addresses the Use After Free condition in the V8 JavaScript engine by correcting the memory management behavior that allowed the vulnerability to be triggered.

Workarounds

• Disable or restrict Chrome extension installation via Group Policy or Chrome Enterprise policies until patching is complete
• Implement extension whitelisting to only allow approved, vetted extensions
• Consider using browser isolation technologies to contain potential exploitation attempts
• Enable Chrome's Enhanced Safe Browsing mode to improve protection against malicious extensions

# Chrome Enterprise policy to restrict extension installation
# Add to Windows Registry or macOS/Linux policy files

# Block all extensions except those explicitly allowed (Windows Registry)
# HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
# ExtensionInstallBlocklist = "*"
# ExtensionInstallAllowlist = [list of approved extension IDs]

# For managed Chrome deployments, use Chrome Browser Cloud Management
# to enforce extension policies across the organization