What is the CVSS score of CVE-2026-5887?

CVE-2026-5887 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5887?

Yes, a patch is available for CVE-2026-5887. Update the affected software to the latest version immediately.

Chrome CVE-2026-5887

EUVD-2026-20701 MEDIUM

Improper Input Validation (CWE-20)

2026-04-08 Chrome

GHSA-24v7-w2x9-2cxh

Authentication Bypass Google Microsoft Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20701

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Google Chrome on Windows prior to version 147.0.7727.55 fails to properly validate user input in the Downloads functionality, allowing remote attackers to bypass download restrictions through a crafted HTML page. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but has low real-world impact-it enables integrity bypass only, not code execution or confidentiality breaches. No public exploit code or active exploitation has been identified; the low EPSS score (0.02%) reflects minimal practical risk despite the network attack vector.

Technical ContextAI

The vulnerability exists in Chrome's Download module and stems from insufficient input validation (CWE-20), a common class of flaws where untrusted data (in this case, HTML-crafted download requests) is processed without proper sanitization or bounds checking. The Downloads subsystem in Chromium-based browsers typically enforces restrictions on file types, destinations, and execution contexts to prevent malicious file downloads. By crafting HTML that bypasses these validation checks, an attacker can circumvent Chrome's download safety mechanisms. This is a platform-specific issue affecting Windows deployments; the vulnerability does not extend to Chrome on macOS, Linux, or Android based on the Windows-specific CPE designation.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later on Windows systems. The patch is vendor-released and available through Chrome's automatic update mechanism, which will typically deploy the fix within 24-48 hours of user session restart. Users can manually trigger an update by clicking the menu icon (three dots) in the top-right corner, selecting 'Help' > 'About Google Chrome,' and allowing the browser to check for and install the latest version. No workaround exists short of updating; the download restriction bypass cannot be mitigated through configuration or policy without patching. For enterprise deployments, administrators can use Google's Chrome Enterprise rollout policies to deploy 147.0.7727.55 to managed devices via enterprise tools.