CVE-2026-5277 Integer overflow in Chrome

High 7.5 Published 1 Apr 2026 Updated 2 Apr 2026

A remote attacker with compromised renderer access can perform out-of-bounds memory writes via crafted HTML pages due to an integer overflow in ANGLE.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-5277?

CVE-2026-5277 is a high-severity vulnerability in Google Chrome, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Weakness: CWE-472

Which versions are affected by CVE-2026-5277?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2026-5277?

Upgrade to a fixed version.

Is CVE-2026-5277 being exploited?

There is no known exploitation of CVE-2026-5277 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-5277, GHSA-6mjm-fq7h-cm4p, MINI-9pgp-hp38-7g49.