What is the CVSS score of CVE-2026-5876?

CVE-2026-5876 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5876?

Yes, a patch is available for CVE-2026-5876. Update the affected software to the latest version immediately.

Chrome CVE-2026-5876

EUVD-2026-20682 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-04-08 Chrome

GHSA-9wcm-fcg4-668c

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20682

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage in Google Chrome's Navigation feature prior to version 147.0.7727.55 allows unauthenticated remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability requires user interaction (clicking or navigating to a malicious page) but successfully bypasses same-origin policy protections, exposing sensitive information from different origins. With an EPSS score of 0.03% (10th percentile) indicating very low real-world exploitation probability, this represents a medium-severity information disclosure risk appropriate for routine patching rather than emergency mitigation.

Technical ContextAI

This vulnerability exploits side-channel behavior in Chrome's Navigation API, a web platform feature that manages cross-document navigation and history state. Side-channel attacks infer sensitive information by analyzing indirect signals (timing, cache behavior, or resource metadata) rather than direct data access. CWE-1300 (Information Exposure Through Computational Timing) categorizes timing-based side-channel leaks. The flaw allows attackers to differentiate cross-origin page contents or state without direct API access, violating the same-origin policy assumption. The attack surface is the Navigation API's handling of navigation transitions where timing or observable behavior patterns leak information about target origins not under attacker control.

RemediationAI

Vendor-released patch: Chrome 147.0.7727.55. Users should upgrade to Chrome version 147.0.7727.55 or later through Settings > About > Chrome, which triggers automatic download and installation upon next browser restart. Enterprise administrators managing Chrome via policy should update Chrome deployments to version 147.0.7727.55 or later; consult Google's Chrome Enterprise release notes (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html) for rollout details. No workarounds are available for this Navigation API side-channel; patching is the definitive remediation. Organizations using Chrome in restricted environments should verify patch availability in their deployment channels before scheduling updates.