What is the CVSS score of CVE-2026-5898?

CVE-2026-5898 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5898?

Yes, a patch is available for CVE-2026-5898. Update the affected software to the latest version immediately.

Google CVE-2026-5898

EUVD-2026-20722 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-7rpr-3745-83c9

Information Disclosure Google Apple

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20722

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome on iOS prior to version 147.0.7727.55 allows remote attackers to deceive users through malicious HTML pages that manipulate the Omnibox security indicator, enabling phishing or credential theft without code execution. The vulnerability requires user interaction and has low confidentiality impact, reflected in both the CVSS score of 4.3 and minimal EPSS score of 0.03%, indicating limited real-world exploitation likelihood despite public discoverability.

Technical ContextAI

The vulnerability exists in the Omnibox component-Chrome's unified address and search bar-which displays security indicators (HTTPS lock, site identity, warnings) to help users assess website trustworthiness. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) indicates the flaw stems from improper rendering or spoofing of these critical security UI elements. On iOS specifically, the constraint of iOS UI frameworks combined with the HTML/JavaScript rendering engine allowed attackers to craft pages that visually deceive the Omnibox display, making malicious sites appear legitimate. The iOS platform distinction is significant because Chrome on iOS uses WebKit (Apple's browser engine) rather than Blink, introducing platform-specific security boundaries that this vulnerability exploits.

RemediationAI

Update Google Chrome on iOS to version 147.0.7727.55 or later; most users receive this automatically via App Store updates. No workarounds exist for the UI spoofing flaw itself, though users can reduce phishing risk by verifying site certificates manually (inspect the 'i' icon in the Omnibox) before entering credentials. Detailed patch information is available in the Chrome Releases blog at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/470295118.