What is the CVSS score of CVE-2026-5880?

CVE-2026-5880 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5880?

Yes, a patch is available for CVE-2026-5880. Update the affected software to the latest version immediately.

Google CVE-2026-5880

EUVD-2026-20687 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-4hxj-cq55-f7pf

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.6 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20687

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Omnibox spoofing in Google Chrome prior to 147.0.7727.55 allows remote attackers with a compromised renderer process to spoof the URL bar contents via crafted HTML, deceiving users about the actual page origin. The vulnerability requires renderer process compromise (post-sandbox-escape condition) and user interaction, limiting real-world exploitation to multi-stage attacks. Patch available in Chrome 147.0.7727.55 and later; EPSS score of 0.03% reflects low autonomous exploitation likelihood despite medium CVSS rating.

Technical ContextAI

The vulnerability exists in Chrome's browser user interface policy enforcement layer (CWE-451: User Interface Inconsistency), which manages the security-critical Omnibox display. The Omnibox is the unified address/search bar responsible for displaying the actual site origin to users-a core anti-phishing mechanism. When the renderer process is compromised (via a separate memory safety vulnerability or exploit), an attacker can craft malicious HTML that triggers insufficient validation in the browser's UI policy checks, allowing the renderer to manipulate what appears in the Omnibox without proper enforcement of origin isolation. This breaks the visual trust boundary between the browser chrome (controlled by the privileged browser process) and web content (isolated in the renderer). The affected product is Google Chrome across all platforms (per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), versions prior to 147.0.7727.55.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. Chrome users with auto-update enabled will receive this patch automatically; manual updates can be triggered via Chrome menu (Settings > About Chrome > Check for updates). No workarounds exist short of disabling web browsing. For enterprise deployments, use group policies or device management to force rollout of Chrome 147.0.7727.55+. Verify patch deployment via chrome://version in the address bar (should show version ≥ 147.0.7727.55). Additional details are available in Google's Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.