{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5879", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-04-08T19:34:37.328Z", "datePublished": "2026-04-08T21:20:48.533Z", "dateUpdated": "2026-04-08T21:20:48.533Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "147.0.7727.55", "status": "affected", "lessThan": "147.0.7727.55", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient validation of untrusted input", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-04-08T21:20:48.533Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"url": "https://issues.chromium.org/issues/40073848"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)"}], "id": "CVE-2026-5879", "lastModified": "2026-04-08T22:16:27.537", "metrics": {}, "published": "2026-04-08T22:16:27.537", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/40073848"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "chrome-cve-admin@google.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,147.0.7727.55)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-08T23:13:14.725857+00:00", "value": {"mitigation_remediation": ["Update Google Chrome for macOS to version 147.0.7727.55 or later.", "Enable automatic updates so that future security patches are applied promptly."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution through crafted web content"}, "threat_synthesis": {"affected_systems": "Google Chrome for macOS builds released before version 147.0.7727.55 are affected. Any user running an older version is at risk; installing version 147.0.7727.55 or later removes this issue.", "description_and_impact": "The vulnerability resides in ANGLE, the graphics abstraction layer used by Google Chrome on macOS. An insufficient validation of untrusted input allows a malicious user to embed crafted HTML that, when rendered by the affected browser, causes arbitrary code to execute within the renderer sandbox. The weakness is a classic input validation failure (CWE\u201120). Attacker\u2011controlled code runs with the rights of the sandboxed process, exposing sensitive data or enabling further lateral movement. No evidence of a sandbox escape is provided, so the impact remains confined to the sandbox unless other vulnerabilities exist.", "risk_and_exploitability": "Chromium assigns this flaw a medium severity score. Because no EPSS value is documented, the precise probability of exploitation is unknown. It is also not listed in the CISA KEV catalog, indicating that no known exploitation has been widely observed. The likely attack vector is a malicious webpage that a user visits or opens, as inferred from the mention of a crafted HTML page. Exploitation would require the user to allow the browser to render the malicious content; no additional privileges or user interaction are explicitly required."}}}}, "created": "2026-04-09T08:17:23.569684+00:00", "title": "ANGLE Input Validation Vulnerability Enables Remote Code Execution in Chrome for macOS", "updated": "2026-04-09T08:26:46.972677+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}