What is the CVSS score of CVE-2026-5895?

CVE-2026-5895 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5895?

Yes, a patch is available for CVE-2026-5895. Update the affected software to the latest version immediately.

Google CVE-2026-5895

EUVD-2026-20717 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-x449-4qch-5wjq

Information Disclosure Google Apple

5.4

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

5.4 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20717

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. (Chromium security severity: Low)

AnalysisAI

Google Chrome on iOS prior to version 147.0.7727.55 contains an Omnibox (URL bar) spoofing vulnerability that allows remote attackers to display misleading domain names to users through crafted domains, potentially enabling phishing attacks. The vulnerability requires user interaction (clicking a link) and affects iOS-specific browser UI rendering. While assigned a low Chromium security severity and rated 5.4 CVSS, the practical exploitation probability remains minimal (0.03% EPSS) due to the high user-interaction requirement and limited information-disclosure impact.

Technical ContextAI

The vulnerability stems from incorrect security UI handling in Chrome's Omnibox component (the URL bar that displays the current domain to users). CWE-451 identifies this as a User Interface (UI) Inconsistency issue, where the displayed URL does not accurately reflect the actual domain being visited. On iOS, this affects Google Chrome's rendering layer where crafted domain names can cause the Omnibox to display misleading or spoofed content. The root cause relates to insufficient validation or sanitization of domain-name rendering logic in the iOS-specific Omnibox implementation, allowing attackers to craft domains that render in a deceptive manner when displayed in the security-critical URL bar UI.

RemediationAI

Update Google Chrome on iOS to version 147.0.7727.55 or later. Users can enable automatic updates in the App Store settings under their Apple ID profile, or manually update by opening the App Store app, tapping the profile icon, scrolling to Google Chrome, and tapping 'Update.' No workarounds are available short of upgrading. See the official Chrome release notes at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/374285495 for further technical details.