CVE-2026-5914: Google Chrome Use-After-Free Vulnerability

CVE-2026-5914 Overview

CVE-2026-5914 is a type confusion vulnerability in the Cascading Style Sheets (CSS) engine of Google Chrome prior to version 147.0.7727.55. An attacker who convinces a user to install a malicious Chrome extension can trigger heap corruption through a crafted extension payload. The flaw is classified under CWE-843: Access of Resource Using Incompatible Type. Chromium maintainers rated the internal security severity as Low, while the National Vulnerability Database (NVD) assigned a higher score reflecting the broader impact of heap corruption. Google patched the issue in the Stable channel update for desktop across Windows, macOS, and Linux.

Critical Impact

Successful exploitation can corrupt heap memory inside the browser process, enabling arbitrary code execution within the renderer context and full compromise of confidentiality, integrity, and availability.

Affected Products

• Google Chrome versions prior to 147.0.7727.55
• Chrome on Microsoft Windows, Apple macOS, and Linux desktop platforms
• Chromium-based browsers that inherit the unpatched CSS engine code

Discovery Timeline

• 2026-04-08 - CVE-2026-5914 published to the National Vulnerability Database
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5914

Vulnerability Analysis

The vulnerability resides in Chrome's CSS handling logic. Type confusion occurs when code allocates or accesses a resource as one type but later interprets it as a different, incompatible type. In the CSS engine, this mismatch produces unsafe pointer arithmetic and corrupts adjacent heap structures. The attack requires user interaction, specifically the installation of a malicious Chrome extension that delivers crafted CSS content to the browser. Once loaded, the extension drives the browser into the vulnerable code path and triggers heap corruption. Because extensions operate with elevated privileges relative to typical web content, the resulting memory corruption can be steered toward arbitrary code execution inside the renderer.

Root Cause

The defect is a [CWE-843] type confusion in CSS object handling. The engine treats an object reference as a type other than the one it was originally allocated as, causing field accesses to read or write outside the bounds of the actual object. This produces predictable heap corruption primitives usable for exploitation.

Attack Vector

Exploitation is network-reachable but requires the victim to install a malicious extension from the Chrome Web Store or a sideloaded source. After installation, the extension supplies the crafted CSS that triggers the type confusion. No additional privileges are needed beyond those granted to a standard Chrome extension. Refer to the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-5914

Indicators of Compromise

• Chrome browser versions reporting build numbers below 147.0.7727.55 in enterprise inventory telemetry.
• Recently installed or sideloaded Chrome extensions from untrusted publishers or unknown developer IDs.
• Unexpected Chrome renderer process crashes correlated with extension activity in Windows Event Log or crashpad directories.

Detection Strategies

• Inventory installed Chrome extensions across managed endpoints and compare extension IDs against an allowlist.
• Monitor for Chrome renderer process abnormal termination signals (SIGSEGV, STATUS_ACCESS_VIOLATION) that indicate heap corruption attempts.
• Alert on extension installation events outside of approved deployment workflows, especially those carrying content_scripts matching all URLs.

Monitoring Recommendations

• Collect browser version telemetry through enterprise management tooling and flag hosts below the patched build.
• Forward Chrome extensions directory changes and Preferences file modifications to a centralized logging platform for correlation.
• Track outbound connections from Chrome renderer child processes to non-standard domains following extension installs.

How to Mitigate CVE-2026-5914

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later on all Windows, macOS, and Linux endpoints.
• Audit installed extensions and remove any that are unsigned, sideloaded, or from unverified developers.
• Enforce extension allowlisting through enterprise policy to block installation of unapproved extensions.

Patch Information

Google released the fix in the Stable channel update for desktop documented in the Google Chrome Stable Update advisory. Administrators should deploy Chrome 147.0.7727.55 or later. Chromium-based browsers including Microsoft Edge, Brave, and Opera should be updated once vendors integrate the upstream patch.

Workarounds

• Apply the ExtensionInstallAllowlist and ExtensionInstallBlocklist group policies to restrict extension sources to vetted publishers.
• Disable the Developer mode toggle in chrome://extensions through enterprise policy to prevent sideloading of unpacked extensions.
• Force browser restart after auto-update to ensure the patched binary is loaded into memory.

# Configuration example: Windows Group Policy registry keys for extension control
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f