Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2821 articles · 109423 vulns · 38/41 feeds (7d)
← Back to list
—
CVE-2026-5858EXPLOITEDPATCHED
google · google chrome

CVE-2026-5858: Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary cod

Description

A vulnerability, which was classified as critical, has been found in Google Chrome. Affected by this vulnerability is an unknown functionality of the component WebML. This manipulation causes heap-based buffer overflow. Remote exploitation of the attack is possible.

Affected Products

VendorProductVersions
googlegoogle chrome147.0.7727.55, 146.0.7680.178, 147.0.7727.49

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
googlechromecert_advisory90%
microsoftmicrosoft edgecert_advisory90%

References

  • https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html
  • https://issues.chromium.org/issues/493319454

Related News (3 articles)

Tier B
BSI Advisories1h ago
[NEU] [hoch] Google Chrome und Microsoft Edge: Mehrere Schwachstellen
→ No new info (linked only)
Tier D
Heise Security6h ago
Google Chrome 147: Update stopft 60 Sicherheitslücken, davon zwei kritische
→ No new info (linked only)
Tier C
VulDB11h ago
CVE-2026-5858 | Google Chrome up to 146.0.7680.178 WebML heap-based overflow (ID 493319)
→ No new info (linked only)
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
147.0.7727.55
CWECWE-122
PublishedApr 8, 2026
Last enriched6h agov3
Tags
security updatebug bounty
Trending Score65
Source articles3
Independent3
Info Completeness8/14
Missing: cvss, epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-5281EXPKEV
CVE-2026-5281: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the render
Trending: 120
CRITICALCVE-2026-5859EXP
CVE-2026-5859: Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap
Trending: 65
CRITICALCVE-2026-5860EXP
CVE-2026-5860: Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code ins
Trending: 61
CRITICALCVE-2026-5896EXP
CVE-2026-5896: Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage
Trending: 61
CRITICALCVE-2026-5883EXP
CVE-2026-5883: Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code insi
Trending: 61

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Apr 8, 2026
Discovered by ZDM
Apr 8, 2026
Actively Exploited
Apr 8, 2026
Patch Available
Apr 8, 2026
Updated: description, affectedVersions, severity, activelyExploited
Apr 9, 2026
Updated: affectedVersions, tags
Apr 9, 2026

Version History

v3
Last enriched 6h ago
v3Tier D6h ago

Added affected version 147.0.7727.49, marked exploit as available, updated patch version, and added new tags related to the security update.

affectedVersionstags
via Heise Security
v2Tier C11h ago

Updated description with more technical detail, changed severity to CRITICAL, and added new affected version 146.0.7680.178.

descriptionaffectedVersionsseverityactivelyExploited
via VulDB
v114h ago

Initial creation