What is the CVSS score of CVE-2026-5889?

CVE-2026-5889 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5889?

Yes, a patch is available for CVE-2026-5889. Update the affected software to the latest version immediately.

Google CVE-2026-5889

EUVD-2026-20705 MEDIUM

Inadequate Encryption Strength (CWE-326)

2026-04-08 Chrome

GHSA-mp5w-52hw-836r

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.2 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20705

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)

AnalysisAI

Cryptographic weakness in PDFium allows unauthenticated remote attackers to decrypt and read sensitive information from password-protected PDFs through brute-force attacks when users view malicious or compromised PDF files in Google Chrome versions prior to 147.0.7727.55. The vulnerability requires user interaction (opening a PDF) but combines weak cryptographic design (CWE-326) with low attack complexity, making it feasible for attackers to extract confidential content from encrypted documents. EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite Chromium's medium severity classification.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers including Google Chrome. The vulnerability stems from insufficient key derivation or weak encryption parameters in PDFium's PDF decryption implementation, classified as CWE-326 (Inadequate Encryption Strength). PDF encryption typically uses RC4 or AES ciphers with password-based key derivation; weak implementation allows attackers to computationally enumerate possible decryption keys faster than intended. The flaw affects the cryptographic layer that processes encrypted PDF documents before rendering, meaning any PDF with owner or user password protection becomes vulnerable to offline brute-force attacks once retrieved by an attacker.

RemediationAI

Upgrade Google Chrome to version 147.0.7727.55 or later immediately to receive the patched PDFium implementation. Users on Windows, macOS, and Linux can enable automatic updates or manually check Settings > About > Google Chrome for update installation. For organizations requiring manual deployment, the stable channel release is documented at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. No workarounds exist for the cryptographic flaw itself; users should avoid opening PDFs from untrusted sources and consider disabling PDF preview in email clients until patched. Chromium-based browsers should check their respective update channels for patched versions incorporating the upstream fix (reference https://issues.chromium.org/issues/486906037 for technical details).