Home / Vulnerability Intelligence / CVE-2026-5278

CVE-2026-5278 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: April 1, 2026

Google Chrome - Use After Free

Published: April 1, 2026Updated: April 1, 2026Remote Exploitable

Overview

Google Chrome on Android < 146.0.7680.178 contains a use after free vulnerability in Web MIDI, letting remote attackers execute arbitrary code via crafted HTML pages, exploit requires victim to visit malicious page.

Severity & Score

Severity: High

CVSS Score: 8.8

EPSS Score: 3.3%(Probability of exploitation in next 30 days)

Impact

Remote attackers can execute arbitrary code, potentially taking full control of the device.

Mitigation

Update to version 146.0.7680.178 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Apr 1, 2026

🟠 CVE-2026-5278 - High (8.8) Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Apr 1, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-5278
Severity: High
CVSS Score: 8.8
Type: use_after_free
Status: confirmed
EPSS: 3.3%
Social Posts: 2

CWE

CWE-416

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

3.3%Probability of exploitation in the next 30 days