What is the CVSS score of CVE-2026-5881?

CVE-2026-5881 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5881?

Yes, a patch is available for CVE-2026-5881. Update the affected software to the latest version immediately.

Chrome CVE-2026-5881

EUVD-2026-20689 MEDIUM

Improper Access Control (CWE-284)

2026-04-08 Chrome

GHSA-x5c8-43vf-fmpc

Authentication Bypass Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

6.5 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20689

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Google Chrome versions prior to 147.0.7727.55 contain a policy bypass vulnerability in the LocalNetworkAccess feature that allows remote attackers to circumvent navigation restrictions by delivering a crafted HTML page. An unauthenticated attacker requires only user interaction (clicking or viewing the malicious page) to trigger the bypass, resulting in integrity compromise of network access policies. EPSS exploitation probability is low at 0.02%, and no public exploit code or active exploitation has been reported.

Technical ContextAI

LocalNetworkAccess is a Chrome security feature that restricts web pages from accessing resources on the local network (RFC 1918 private IP ranges and localhost), protecting against attacks where a compromised public website pivots to internal infrastructure. This vulnerability stems from improper input validation or policy enforcement logic (CWE-284: Improper Access Control), likely in the HTML parser or network request filtering logic. The flaw allows carefully crafted HTML attributes, JavaScript, or navigation triggers to bypass the policy checks that should block requests to local network endpoints. The vulnerability affects all Chrome browser instances on Windows, macOS, and Linux platforms using CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Users should upgrade Google Chrome to version 147.0.7727.55 or later, which includes the patch for this LocalNetworkAccess bypass. Chrome on Windows, macOS, and Linux will auto-update to the patched version; users can manually verify the update by navigating to chrome://settings/help. Enterprise administrators can force deployment via group policy or mobile device management (MDM) policies. No workaround is available for users on unpatched versions other than disabling LocalNetworkAccess features via enterprise policy if organizational risk tolerance permits. Patch details and the stable channel update are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/454162508.