CVE-2026-5873

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55

Description An out-of-bounds read and write issue exists in the V8 JavaScript engine, specifically within the Turboshaft WebAssembly compiler. The flaw occurs because the i32.convert i64 function truncates a 64-bit index to 32 bits before shifting it left by 2; during the tier-up process from Liftoff to Turboshaft, the bounds check is eliminated. This allows a remote attacker to execute arbitrary code inside a sandbox by enticing a user to visit a specially crafted HTML page. Real-world exploitation has been demonstrated on macOS ARM64 using a bundled Chromium instance in Discord to achieve remote code execution (RCE) by popping the Calculator application.

Recommendations Update Google Chrome to version 147.0.7727.55 or later.