What is the CVSS score of CVE-2026-5896?

CVE-2026-5896 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5896?

Yes, a patch is available for CVE-2026-5896. Update the affected software to the latest version immediately.

Google CVE-2026-5896

EUVD-2026-20719 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-08 Chrome

Authentication Bypass Google

6.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.1 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

6.1 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20719

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Google Chrome prior to version 147.0.7727.55 contains a sandbox bypass vulnerability in the Audio subsystem that allows remote attackers to circumvent download policy restrictions by convincing users to perform specific UI gestures on a crafted HTML page. The vulnerability has low practical exploitability (EPSS 0.02%) and requires active user interaction, limiting real-world risk despite cross-origin scope impact.

Technical ContextAI

This vulnerability exists in Chrome's Audio policy enforcement mechanism (CWE-693: Improper Removal of Sensitive Information Before Storage or Transmission), where the sandbox's download restriction policies can be bypassed under specific interaction conditions. The affected component is the Audio subsystem within Chromium's multi-process sandbox architecture. When a user performs particular UI gestures on attacker-controlled HTML content, the Audio policy validator fails to properly maintain sandbox isolation boundaries, allowing file operations that should be blocked by the download policy. The vulnerability affects all versions of Google Chrome prior to 147.0.7727.55 across all platforms covered by the CPE designation (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*).

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately, as vendor-released patches are available. Users should enable automatic updates in Chrome settings (Settings > About Google Chrome) to receive this security patch. No known workarounds exist for this policy bypass vulnerability, so patching is the primary mitigation. Refer to the Chrome Releases Blog (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html) for official patch details and the Chromium issue tracker (https://issues.chromium.org/issues/40064543) for technical discussion.