What is the CVSS score of CVE-2026-5899?

CVE-2026-5899 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-5899?

Yes, a patch is available for CVE-2026-5899. Update the affected software to the latest version immediately.

Chrome CVE-2026-5899

EUVD-2026-20723 MEDIUM

Origin Validation Error (CWE-346)

2026-04-08 Chrome

GHSA-7xx9-pp7c-pv8h

Google Code Injection Red Hat Suse Chrome

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.0 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

6.1 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20723

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in History Navigation in Google Chrome prior to version 147.0.7727.55 enables cross-site scripting (UXSS) attacks when users perform specific UI gestures on attacker-controlled pages, allowing injection of arbitrary scripts or HTML with potential impact on user data confidentiality and integrity. The vulnerability affects all Chrome versions before 147.0.7727.55 across all platforms, requires user interaction with specific UI gestures but no authentication, and carries a low Chromium severity rating despite a moderate CVSS score. No public exploit code has been identified at the time of analysis, though the vulnerability was tracked via Chromium issue tracking.

Technical ContextAI

The vulnerability stems from insufficient policy enforcement in Chrome's History Navigation feature (CWE-346: Origin Validation Error), which manages browser history state and navigation flows. The issue allows an attacker to bypass same-origin policy restrictions through the History Navigation API or related mechanisms when combined with specific user gestures. This is distinct from typical UXSS variants because it specifically exploits the history navigation pathway rather than direct DOM manipulation, suggesting the vulnerability lies in how Chrome validates the origin context when restoring or accessing pages via back/forward navigation or history manipulation. The affected technology involves Chromium's history handling subsystem and JavaScript execution context validation during navigation state transitions.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately via the automatic update mechanism (Help > About Google Chrome triggers download and installation on next restart). Users on managed environments should push this version via their standard Chrome deployment tools (Google Admin Console, Microsoft Intune, or equivalent). No interim workarounds are effective; the only mitigation is patching. Refer to Google's official advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and Chromium issue tracker at https://issues.chromium.org/issues/474817168 for technical details.