What is the CVSS score of CVE-2026-5882?

CVE-2026-5882 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5882?

Yes, a patch is available for CVE-2026-5882. Update the affected software to the latest version immediately.

Google CVE-2026-5882

EUVD-2026-20691 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-h6cm-pcwj-hj57

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20691

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome fullscreen mode prior to version 147.0.7727.55 allows remote attackers to deceive users with crafted HTML pages displaying fake security UI elements, potentially leading to credential theft or malware distribution through trusted-looking interface impersonation. The vulnerability requires user interaction (clicking/navigating to the malicious page) but poses moderate integrity risk due to the deceptive nature of fullscreen UI manipulation. No active exploitation has been confirmed, though the attack vector is straightforward for mass phishing campaigns.

Technical ContextAI

This vulnerability resides in Google Chrome's fullscreen API security controls, specifically the validation and rendering of security UI elements when web content enters fullscreen mode. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) identifies the root cause: the browser fails to adequately distinguish between legitimate browser security UI and content-controlled UI, enabling attackers to create HTML pages that mimic critical security dialogs, address bars, or warnings while running in fullscreen. The flaw affects all Chrome versions before 147.0.7727.55 across all platforms covered by the generic CPE specification cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Users should update Google Chrome to version 147.0.7727.55 or later immediately. Google Chrome's automatic update feature typically deploys security patches within 24-48 hours of release; users can manually trigger updates via Chrome Menu > Help > About Google Chrome, which will display the installed version and automatically check for updates. Organizations managing Chrome deployments should consult the Chrome Enterprise release notes at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for deployment timelines. No workaround is available for users unable to immediately patch; however, users can mitigate risk by avoiding opening untrusted HTML files or links in fullscreen mode and disabling fullscreen requests in untrusted contexts if browser extensions or policies permit.