What is the CVSS score of CVE-2026-5897?

CVE-2026-5897 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5897?

Yes, a patch is available for CVE-2026-5897. Update the affected software to the latest version immediately.

Google CVE-2026-5897

EUVD-2026-20721 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-2x9w-3q66-8rrm

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20721

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Downloads interface prior to version 147.0.7727.55 allows remote attackers to deceive users into performing unintended actions via crafted HTML pages exploiting incorrect security UI rendering. The vulnerability requires user interaction with specific UI gestures on a malicious webpage, resulting in limited integrity impact through visual deception rather than code execution or data exfiltration. Although marked as low severity by Chromium and carrying minimal exploitation probability (EPSS 0.03%), the attack surface is broad given Chrome's prevalence as a target for social engineering.

Technical ContextAI

This vulnerability resides in Chrome's Downloads UI security layer, specifically in the visual presentation and interaction handling of download-related interface elements. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) classifies the root cause: the browser fails to correctly render or distinguish critical security-related UI elements, allowing attackers to craft HTML content that visually mimics or obscures legitimate download prompts or warnings. The affected component handles the display of download notifications and permission requests, which are rendered via Chromium's UI framework. When a user visits a malicious page and performs specific gestures (likely clicks, hovers, or other interactions), the crafted HTML exploits the rendering flaw to display spoofed UI elements that convince the user the action is legitimate or originates from the browser itself rather than the website.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later, which includes the fix for the incorrect Downloads UI security rendering. Chrome's auto-update mechanism will deploy this version to most users automatically; users can manually verify their current version via Settings > About Chrome, which will prompt an immediate update check. No workarounds are available for unpatched versions; the vulnerability requires a browser update to resolve. For organizational deployments, administrators should ensure Chrome is configured to auto-update or deploy version 147.0.7727.55+ via enterprise management tools. Additional resources and technical details are available in the Chrome stable channel release notes at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the upstream bug tracker at https://issues.chromium.org/issues/419921726.