cve 2026 5872

CVE-2026-5872 is a use-after-free vulnerability in the Blink rendering engine that affects Google Chrome versions prior to 147.0.7727.55. A remote attacker can exploit this flaw by luring a user to a crafted HTML page, potentially executing code within the browser sandbox. Microsoft has tracked this issue in its Security Update Guide since April 8, 2026, indicating it is an active patching item for enterprise defenders. The vulnerability follows the standard Chromium disclosure process, where a fix is rolled into a specific stable build. WindowsForum discussions cover the technical details, affected versions, and mitigation steps for this CVE.