What is the CVSS score of CVE-2026-5900?

CVE-2026-5900 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5900?

Yes, a patch is available for CVE-2026-5900. Update the affected software to the latest version immediately.

Google CVE-2026-5900

EUVD-2026-20724 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-08 Chrome

GHSA-x4jg-wm7v-8287

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20724

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Google Chrome versions prior to 147.0.7727.55 contain a policy bypass vulnerability in the Downloads feature that allows remote attackers to circumvent multi-download protections through a crafted HTML page. The vulnerability requires user interaction (clicking or accepting a download), affects integrity only (no code execution or availability impact), and carries a low Chromium severity rating. EPSS exploitation probability is minimal at 0.02% (3rd percentile), indicating this is primarily a user-experience or policy-enforcement issue rather than a critical security risk.

Technical ContextAI

This vulnerability exists in Chrome's Downloads component security policy enforcement mechanism, classified under CWE-693 (Protection Mechanism Failure). The issue involves improper validation or enforcement of multi-download protection policies-features designed to prevent rapid or bulk malicious downloads. The vulnerability does not affect the core security architecture of Chromium's sandboxing, process isolation, or content security policy implementation; rather, it represents a gap in higher-level user-facing protection controls that warn or block suspicious download patterns. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome variants across platforms are affected until the patched version.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. Users on Windows, macOS, and Linux can trigger updates via Chrome Menu > Help > About Google Chrome, which will automatically download and install the latest version (requiring a browser restart). Enterprise administrators should use Google Chrome for Business or Chrome Enterprise to centrally manage updates via policy. No workarounds are available, but the low EPSS score indicates this is not an urgent zero-day requiring emergency patching-standard update schedules suffice. Reference the Chrome stable channel release notes at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/475265304 for technical details.